Administrator audit data

Information about the administrator audit data that you can generate for different report types in MaaS360.

This feature presents all the administrator actions or changes that are made in settings or compliance rules or groups or policies as audit report. You can request administrator audit data for different report types for previous 60 days. The requested audit data is generated in CSV file format and sent to the recipient's email addresses that can be used for further processing.

Follow these steps to generate administrator audit data:

  1. From the IBM® MaaS360® Portal home page, select Reports > Audit > Administrators.
  2. On the Administrator Audit Report page, select the From Date and To Date for the period for which you want to generate data.
    Note: You can generate data for last 60 days for all the report types.
  3. Select the check boxes next to the report types for which you want to generate data.
    Note: You can select all the report types at once.
  4. Enter the email address of the recipient in the Recipient email(s) text box.
  5. Click Generate report(s).

    The administrator audit data for the selected report types is generated in CSV file format and sent to the recipient's email address within 30 minutes.

    Note: A maximum of three requests can be submitted every 24 hours.

You can generate administrator audit data for the following report types:

Administrator Login report

The Administrator Login report provides the history of the login and logout status of all the administrators into the MaaS360 Portal for the previous 60 days.

Field Description Possible values
Username The name of the administrator for which the Administrator Login report is generated.  
Login attempt time The date when the administrator attempted to log in to the portal. Example: 02/23/2021 05:07 EST
Logout time The date when the administrator logged out of the login session. Example: 02/23/2021 05:07 EST
Duration (in minutes) The time duration that the administrator was logged in to the portal. Example: 30.8 minutes
Operating system The operating system of the device that the administrator used to log in to the portal. Example: macOS 10.15.4
Browser version The version of the browser that the administrator used to log in to the portal. Example: Chrome 84.0.4147.89
IP address The IP address of the device that the administrator logged in from. Example: 106.XX.XX.XX
Authentication status The authentication status when the administrator logged in to the portal.
  • Successful: The login authentication succeeded.
  • User authentication failed: The login authentication failed.

Administrator Changes report

The Administrator Changes report provides the change history details of all the administrator accounts that were added, modified, or deleted in the MaaS360 Portal for the previous 60 days.

Field Description Possible values
Update date The date when the change was initiated on the administrator account. Example: 05/04/2017 12:19 IST
Performed by The administrator who initiated the change. Example: admin_username
Operation type The type of operation performed on the administrator account. Example: Add, Change, Delete
Browser version The version of the browser that the administrator used to log in to the portal. Example: Chrome 84.0.4147.89
IP address The IP address of the device that the administrator initiated the change from. Example: 106.XX.XX.XX
Email The email address of the administrator for which the change is performed.  
Username The username of the administrator for which the change is performed.  
First Name The firtsname of the administrator for which the change is performed.  
Middle Name The middlename of the administrator for which the change is performed.  
Last Name The lastname of the administrator for which the change is performed.  
Address The address of the administrator for which the change is performed.  
Phone The phone number of the administrator for which the change is performed.  
Job Title The job title of the administrator for which the change is performed. Example: CXO
WatchList Subscription Indicates whether watchlist subscription is turned on for the administrator for which change is performed. Example: Y
Account Status Indicates the account status of the administrator for which the change is performed. Example: Active
Managed UserGroups Indicates the managed user groups of the administrator for which change is performed. Example: All groups
Last Login Time Indicates the last login time of the administrator for which the change is performed. Example: 02-Mar-23 07.02.12.000
Roles Added Indicates the roles that are added to the administrator for which the change is performed. Example: Administrator, Administrator - Level 2, App Approver
Roles Deleted Indicates the roles that are deleted for the administrator for which the change is performed. Example: Help Desk, Read-Only, Service Administrator
Previous State Indicates the state before the change was initiated on the administrator.  

Administrator Roles report

The Administrator Roles report provides the change history details for all the changes that are made to the administrator's role for the previous 60 days.

Field Description Possible values
RoleId The ID of the role for which the change was performed.  
RoleName The name of the role for which the change was performed.  
Role Description The description of the role for which change was performed.  
Modified date The date when the change was initiated on the administrator role. Example: 05/04/2017 12:19
Modified By The administrator who initiated the change on the role record. Example: admin_username
Operation The type of operation performed on the role record.
  • Add: Creates a new role.
  • Change: Modifies role details.
  • Delete: Deletes a role. This deletion is audited in the database and not displayed in the user interface.
Access Right Modified The list of access rights that were modified as part of the changes that are made to a role. Example: {"eventType":"ADD","name":"Action History","category":"Device Management","description":"Ability to view a global action history across all devices."}

Group Changes report

The Group Changes report provides the change history details for all the changes that are made to the groups in the MaaS360 Portal for the previous 60 days.

Field Description Possible values
Group Name The name of the group for which the change was performed.  
Group Type

The type of the group for which the change was performed.

Example: Local User Group
Created By

The administrator who created the group.

Example: created_admin_username
Created Date

The date when the group was created.

Example: 15-Feb-23 13.25.33.000
Is Active

Indicates whether the group is active.

Example: Yes, No
Is Private Indicates whether the group is set as Private.

Example: Yes, N/A
Is Managed Indicates whether the group is a managed group.

Example: Yes, N/A
Action Type Indicates the type of action that is taken on the group.

Example: Add User Group, Edit User Group, Delete User Group
Action Performed By The administrator who initiated the change on the group.

Example: admin_username
Action Performed On The date when the change was initiated on the group.

Example: 16-Mar-23 09.10.15.576
Previous State Indicates the state before the change was initiated on the group.
  • For Add User Group: N/A
  • For Edit User Group (on editing group name and description)

    Example: Name: "group_name", Description: "group_description"

    →
  • For Delete User Group:

    Example: Name : "group_name", User group to be available for: "Security (Policies, Compliance Rules, Locations, and Privacy Settings)"
New State Indicates the state after the change was completed on the group.
  • For Add User Group

    Example: Name: "group_name", User group to be available for: "Security (Policies, Compliance Rules, Locations, and Privacy Settings)"

  • For Edit User Group (on editing group name and description)

    Example: Name: "edited_group_name", Description: "edited_group_description"

  • For Delete User Group: N/A

Rules Changes report

The Rule Changes report provides the change history details for all the changes that are made to the rules in the MaaS360 Portal for the previous 60 days.

Field Description Possible values
RuleSet Name The name of the ruleset for which the change was performed.

Sample Rule: It is dynamic based on administrators' s configuration.
Default Indicates whether the rule is set as default. Example: Yes, No
Priority Indicates the precedence that is assigned to the rule. Example: 1, 2
Global Indicates whether the rule is set as Global. Example: Yes, No
Modified By

The administrator who initiated the change on the ruleset.

  
Modified Date

The date when the change was initiated on the ruleset.

 2023-03-02 11:19:44.139096
Action Type

The type of action taken on the ruleset.

 Example: CREATE, UPDATE

Services report

The Services report provides the change history details for all the changes that are made to the services in the MaaS360 Portal for the previous 60 days.

Field Description Possible values
Update Date

The date when the change was initiated on the service.

Example: 01-Mar-23 09.44.15.809
Performed By

The administrator who initiated the change on the service.

 Example: Fortress user
IP Address

The IP address of the device that the administrator initiated the change from.

  
Service Key The display name for the service. Example: SECURE_EMAIL, UEM
Description The description for the service key. Example: Enable MaaS360 email.
Parent Service Key The parent service key of the service.
Note: This value is populated only if sub services are present and an action is performed on a sub service.
  
Parent Description The description for the parent service key.
Note: This value is populated only if subservices are present and an action is performed on a sub-service.
  
Action

The type of action taken on the service.

 Example: Enable, Disable

Deployment Settings report

The Deployment Settings report provides the change history of all the changes that are made to the deployment settings in the MaaS360 Portal for the previous 60 days.

Field Description Possible values
Modified by The administrator who initiated the change on the deployment settings.  
Modified on

The date when the change was initiated on the deployment settings.

 Example: 03-Mar-23 07.05.59.215
Previous state

Indicates the state before the change was initiated on the deployment settings.

 Example: {"depSettingsUserAuthMode":{"authMechanism":"passcode","defaultDomainForUsers":"","allowedDomains":"","limitSelfEnrollmentToUserGroup":[]},"devicePlatformAllowed":"iPhone, iPad,iPod,Android,Mac,Windows Devices","depSettingsCorpInfo":{"enable":"Yes","iosServiceHostName":"testflk m9 test","contactEmail":"","phoneNumber":"","customInstructions":""}}
New state Indicates the state after the change was completed on the deployment settings. Example: {"depSettingsUserAuthMode":{"authMechanism":"azuread","defaultDomainForUsers":"","allowedDomains":"","limitSelfEnrollmentToUserGroup":[]},"devicePlatformAllowed":"iPhone,iPad,iPod,Android,Windows Devices","depSettingsCorpInfo":{"enable":"Yes","iosServiceHostName":"testflk_iq1_customer1","contactEmail":"","phoneNumber":"","customInstructions":""}}

Login Settings report

The Login Settings report provides the change history of all the changes that are made to the login settings in the MaaS360 Portal for the previous 60 days.

Field Description Possible values
Modified Date

The date when the change was initiated on the login settings.

 Example: 01-Mar-23 09.52.25.561
Modified By

The administrator who initiated the change on the login settings.

  
Authentication Mechanism The authentication mechanism assigned for the login settings. Example: MaaS360 Local Account
Config The configurations that are related to login settings. Example: MaaS360 Local Account
Device Registration required Indicates whether registration of the device is required as part of login settings. Example: No
Enable OTP Indicates whether enablement of OTP is allowed as part of login settings. Example: No
Previous State Indicates the state before the change was initiated on the login settings. example: {"authenticationMechanism":"Customer User Directory"}

User Notification Settings report

The user Notification Settings report provides the change history of all the changes that are made to the user notification settings in the MaaS360 Portal for the previous 60 days.

Field Description Possible values
Update Date

The date when the change was initiated on the user notification settings.

 Example: 03-Mar-23 07.05.58.802
Performed By

The administrator who initiated the change on the user notification settings.

  
IP Address

The IP address of the device that the administrator initiated the change from.

 Example: 106.XX.XX.XX
Previous State The state before the action was initiated on the user notification settings. Example: {"name":"App Management","description":"Email notifications that are sent to users to welcome them to the App Catalog as well as notifications of new app or upgrade distributions to their devices.","action":"Disabled"}
New State The state after the action was completed on the user notification settings. Example: {"name":"App Management","description":"Email notifications that are sent to users to welcome them to the App Catalog as well as notifications of new app or upgrade distributions to their devices.","action":"Enabled"}

Policies Changes report

The Policies Changes report provides the change history of all the changes that were applied to policies in the MaaS360 Portal for the previous 60 days.

Field Description Possible values
Policy Name The name of the policy for which the change was initiated. Example: Default iOS MDM Policy, Default Android MDM Policy
Policy Type Type of the policy for which the change was initiated. Example: Android MDM,macOS MDM,WorkPlace Persona
Default Indicates whether the policy is set as default. Example: Yes
Priority Indicates the precedence that is assigned to the policy. Example: 1, 2
Global Indicates whether the policy is set as Global. Example: Yes
Modified By

The administrator or the workflow, which initiated the change.

 Example: <username>, Registration service
Modified Date

The date when the change was initiated on the policy.

 Example: 2023-03-02 09:34:40
Action Type The type of action taken on the policy. Example: CREATE, PUBLISH, SET_DEFAULT