![[]](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg){kind=link}
- Overview
- Get started
- Overview
- Replace your VPN
- Secure private apps
- Videos
- Insights
- Overview
- Analytics overview
- Network visibility
- Diagnostics
- Logs
- Overview
- Dashboard logs
- Logpush integration
- Team and resources
- Application Library
- Devices
- Overview
- Cloudflare One Client
- Device registration
- Networks
- Connectivity options
- Connectors
- Cloudflare Tunnel
- Overview
- Configure a tunnel
- Private networks
- Overview
- Connect with cloudflared
- Published applications
- Monitor tunnels
- Other tunnel types
- Overview
- Locally-managed tunnels
- Quick Tunnels
- Cloudflare WAN
- Overview
- WAN transformation
- Get started
- On-ramps
- Configuration
- Configure with Connector
- Overview
- Configure hardware Connector
- Configure Virtual Appliance
- Network options
- Device metrics
- Reference
- Troubleshooting
- Third-party integration
- Alibaba Cloud VPN Gateway
- Amazon AWS Transit Gateway
- Aruba EdgeConnect Enterprise
- Cisco IOS XE
- Cisco Meraki MX (static routing)
- Cisco SD-WAN
- Fortinet
- Furukawa Electric FITELnet
- Google Cloud VPN
- HPE Juniper Networking SRX Series Firewalls
- Microsoft Azure
- Oracle Cloud
- Palo Alto Networks NGFW
- pfSense
- SonicWall
- Sophos Firewall
- strongSwan
- Ubiquiti
- Velocloud
- VyOS
- Yamaha RTX Router
- Security filters
- Cloudflare One integration
- Network Interconnect (CNI)
- Load Balancing
- Public to private via Cloudflare WAN Beta
- Legal
- Granular permissions for Tunnels and Mesh nodes
- Resolvers and proxies
- Virtual networks
- Access controls
- Overview
- Applications
- Overview
- Choose an application type
- Add web applications
- Overview
- SaaS applications
- Overview
- Generic OIDC application
- Generic SAML application
- Adobe Acrobat Sign
- Area 1
- Asana
- Atlassian Cloud
- AWS
- Braintree
- Coupa
- Digicert
- DocuSign
- Dropbox
- GitHub Enterprise Cloud
- Google Cloud
- Google Workspace
- Grafana
- Grafana Cloud
- Greenhouse Recruiting
- Hubspot
- Ironclad
- Jamf Pro
- Miro
- PagerDuty
- Pingboard
- Salesforce (OIDC)
- Salesforce (SAML)
- ServiceNow (OIDC)
- ServiceNow (SAML)
- Slack
- Smartsheet
- SparkPost
- Tableau Cloud
- Workday
- Zendesk
- Zoom
- Self-hosted public application
- Managed OAuthBeta
- Authorization cookie
- Linked App Token
- Add bookmarks
- Service credentials
- Authenticate coding agents
- Event subscriptions
- Troubleshoot Access
- Traffic policies
- Cloud and SaaS findings
- Email security
- Overview
- Retro Scan
- Setup
- Before you begin
- Post-delivery deployment
- API deployment
- BCC/Journaling
- Pre-delivery deployment
- Manage domains
- Monitoring
- Investigation
- Settings
- Domain management
- Auto-move events
- Directories
- Overview
- Manage integrated directories
- Manage Email security directories
- PhishGuard
- Outbound Data Loss Prevention (DLP)
- Troubleshoot Email security
- Email security API API
- Data loss prevention
- Overview
- Data classification
- DLP settings
- Scan HTTP traffic
- Scan SaaS apps
- Scan AI Gateway traffic
- Troubleshoot DLP
- Reusable components
- Integrations
- Cloud and SaaS integrations
- Identity providers
- Overview
- Cloudflare as identity provider
- One-time PIN login
- Generic OIDC
- Generic SAML 2.0
- IdP federation
- Active Directory (SAML)
- Amazon Cognito
- AWS IAM (SAML)
- Centrify
- Centrify (SAML)
- Citrix ADC (SAML)
- GitHub
- Google Workspace
- JumpCloud (SAML)
- Keycloak (SAML)
- Microsoft Entra ID
- Okta
- Okta (SAML)
- OneLogin
- OneLogin (SAML)
- PingFederate
- PingOne
- PingOne (SAML)
- Signed AuthN requests (SAML)
- Yandex
- Roles and permissions
- Tutorials
- Reference architecture
- Account limits
- FAQ
- API and Terraform
- Glossary
- Home
- /Cloudflare One
- /…
- /Dashboard logs
- /Admin activity logs
Admin activity logs
OverviewExplanation of the fieldsExport admin activity logs
Admin activity logs record configuration changes made by members of your Cloudflare account. These logs are useful for auditing who changed a policy or setting and investigating unexpected configuration changes. Use these logs to monitor when a member creates, updates, or deletes configurations in your Zero Trust organization.
To view admin activity logs, log in to the Cloudflare dashboard and go to Zero Trust > Insights > Logs > Admin activity logs.
| Field | Description | Example Value |
|---|---|---|
| User who performed the action | josephli@cloudflare.com | |
| Product | Cloudflare product being modified | Tunnel |
| Resource | Specific resource type within the product | Route |
| Event | Action performed (Create, Update, Delete) | Create |
| Date | Timestamp of when the action occurred | April 30, 2026 12:19 AM |
| User IP Address | IP address of the user who made the change | 2a09:bac6:6447:523::83:30 |
| Interface | How the change was initiated | API |
| Audit record | Unique identifier for the audit log entry | caf1a547-17cc-484a-b4ce-5d3b32771a8f |
| Old value | Previous configuration state (empty for creates) | |
| New value | New configuration state after the change | JSON object with fields like comment, network, tun_type, tunnel_id, virtual_network_id |
Enterprise users can export admin activity logs to a third-party storage destination or SIEM using Logpush. For a list of all available fields, refer to Audit Logs V2.
2026 Cloudflare, Inc.
[privacy options]Your privacy choices
[privacy options]Your privacy choices![[privacy options]](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=26,height=12,format=svg/_astro/privacyoptions.BWXSiJOZ.svg){kind=link}