Every team has an activity log: a record of what happened in the team, as far as the server can see. Owners and admins can read and download it, on every plan.
What it records
- The team being created, renamed, or its policies changed.
- Invites sent and cancelled; people joining, being confirmed, removed or leaving; role changes and ownership transfers.
- New devices signing in to members' accounts.
- Vaults created and deleted; access given, changed and taken away; key rotations.
- Device approval requests, approvals and denials.
- Single sign-on set up, removed, and members signing in with it.
- SCIM tokens created and revoked, and changes made by your identity provider, shown as Provisioning.
- Audit stream changes.
What it can't record
The server can't see inside vaults, so the log never shows which hosts anyone opened, what they ran, or what an item contains. Vault names are encrypted; the app shows them to people who can open the vault and a vault you can't open to others. No IP addresses are kept in the log.
Read it in the app
Open the team in Teams. Under Activity, choose Show activity. Events appear as sentences, newest first, for example "ana@example.com gave marko@example.com access to Production (can edit)". Show older loads more. The app shows the most recent events; for older ones, download the log.
Read it on the website
The team page at morphgate.com shows the newest 50 events under Recent activity.
Download it
- In the app, Download CSV or Download JSON lines saves the whole log.
- On the team page, Download all activity (CSV) does the same.
The CSV has one row per event: sequence number, time, kind, who did it and to whom (id and email), the vault, and a detail. Cells that would start a spreadsheet formula are made safe. The JSON lines file has one event per line with the same fields.
How long it's kept
On morphgate.com, the activity log is kept for one year on the Team plan and three years on the Business plan. If a team leaves Business, events older than a year are deleted. Deleting a team deletes its log.
Send it to your own systems
Business teams can have new events posted to their SIEM or log collector as they happen. See Audit stream.