---
title: Audit log information
slug: dmg-android/guide/audit-log-information
createdAt: 2026-10-06T07:46:36.808Z
---

Several categories of information are available for you to view and audit. The category list, displayed on the left side of the Audit Logs page, includes:

- Device
- ActiveSync Device
- MDM
- Certificate
- App Tunnel
- App
- Policy
- Compliance Action
- Configuration
- DEP (Device Enrollment)
- Admin
- User
- LDAP
- Other
- Label
- Sentry
- AfW
- Custom Attributes
- Compliance Policy
- E-FOTA
- Migration
- MTD (Mobile Threat Defense)
- Access Integration
- Derived Credential Provider
- Zebra FOTA

## Before and after log information

Changes in the modification history for configurations, policies, labels, compliance groups, rules, and actions attributes are displayed in the **Configuration Details** page, which shows before and after content. You can view the logs from the **Ivanti EPMM Logs > Audit Logs** page. Logs with before and after values display an icon you can click to see the new information. The new log information is generated for the following actions:

- Create - The "Before" column will be empty.
- Edit or change - Both before and after values display.
- Delete - The "After" column will be empty.

In Ivanti EPMM version 11.10.0.0 and later versions, the before and after values can be readily identified from unchanged content because they are highlighted and in blue text in the **Changes - Before & After** panel.

To display the **Changes - Before & After** panel, click on any policy or configuration in the **Policies & Configurations > Configurations** tab to display the **Configuration Details** side panel to the right of the window. Click **Modification History**, and click the box corresponding to the change.

**Related topics **

- [About Ivanti EPMM logs](docId\:DvHzXyEefEDbvURbvnWhq)
- [Audit Logs use cases](docId\:WxOWHYt2wxcGqusUgQYZQ)
- [App information](docId\:a0cr7ATS6E_pJ3ZHTtUlc)

## Best practices: label management

If **Notes for Audit Logs** is enabled, whenever a change is made to a label, a text box displays for the administrator to provide a reason for the change.

::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/WY2b2lGwYrxZhCCmQoHw2_reasonpopup.png" position="flex-start" size="77" width="539" height="424" initialPath="../Resources/Images/ReasonPopup.png" githubPath="Device Management Guide for Android/Resources/Images/ReasonPopup.png" darkWidth="539" darkHeight="424" showCaption="false"}

Example text to enter would be a change ticket order number. This information then displays in the Audit logs, in the Details column as "Reason."

![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/renJEXUNohPHIzKuY7Me2_logsauditlogsdisplayed.png)

This affects the following label-related activities:

- Add/Edit/Delete/Save Label (Both filter and manual)
- In Devices & Users > Devices > Advanced Search > Save to Label
- Add/Edit/Remove Label to devices
- Add/Edit/Remove Label to configurations
- Add/Edit/Remove Label to policies
- Add/Edit/Remove Label to apps
- Add/Edit/Remove Label to iBooks

The Notes for Audit Logs feature is also applicable to any administrator-made changes to iOS and macOS restrictions.

To enable this feature, see "Setup tasks" in Getting Started with Ivanti EPMM*.*

## Device events

Device events record device-related actions taken by an administrator in the Admin Portal.

To monitor device actions, select one or more of the logged device actions in the <font color="#323232">Filters</font> panel:

- Allow App Tunnel<font color="#000000">\:</font> <font color="#000000">Manually allow app tunnels from the selected device.</font>
- Apply Label<font color="#000000">\:</font> <font color="#000000">Associate an item with a label.</font>
- Apply Multiple Labels to One Device: Associate an item with multiple labels.
- Block App Tunnel<font color="#000000">\:</font> <font color="#000000">Manually disallow app tunnels from the selected device.</font>
- Cancel Wipe<font color="#000000">\:</font> <font color="#000000">Cancels pending "Wipe" command if it was not yet delivered to the device. Applies to all modes.</font>
- Change Language<font color="#000000">\:</font> <font color="#000000">Change the language associated with a device.</font>
- Change Ownership<font color="#000000">\:</font> <font color="#000000">Toggle device ownership between Employee and Company.</font>
- Check Available OS Update:
- Check Compliance<font color="#000000">\:</font> <font color="#000000">Check device against compliance criteria.</font>
- Delete Retired Device<font color="#000000">\:</font> <font color="#000000">Remove entry for a device that is not longer managed.</font>
- Device Location:
- Disable:
- Disable Activation Lock<font color="#000000">\:</font> <font color="#000000">Turn off the activation lock feature for the selected iOS device.</font>
- Disable Data Roaming<font color="#000000">\:</font> <font color="#000000">Turn off the ability to use data when the device is roaming.</font>
- Disable due to out of compliance:
- Disable Kiosk<font color="#000000">\: Exit kiosk mode on the designated Android device.</font>
- Disable KNOX Container<font color="#000000">\:</font> <font color="#000000">Turn off the Samsung Knox container feature for the selected device.</font>
- Disable Personal Hotspot<font color="#000000">\:</font> <font color="#000000">Prevent the device user from using the personal hotspot feature.</font>
- Disable Voice Roaming<font color="#000000">\:</font> <font color="#000000">Turn off the ability to make voice calls when the device is roaming.</font>
- Download Available OS Update:
- Enable:
- Enable Activation Lock<font color="#000000">\:</font> <font color="#000000">Turn on the activation lock feature for the selected iOS device.</font>
- Enable Data Roaming<font color="#000000">\:</font> <font color="#000000">Turn on the ability to use data while roaming for the selected iOS device.</font>
- Enable Kiosk<font color="#000000">\:</font> <font color="#000000">Start kiosk mode on the designated Android device.</font>
- Enable KNOX Container<font color="#000000">\:</font> <font color="#000000">Turn on the Samsung Knox container feature for the selected device.</font>
- Enable MDM Lost Mode: Enable lost mode for the selected iOS device.
- Enable Personal Hotspot<font color="#000000">\:</font> <font color="#000000">Allow the device user to use the personal hotspot feature.</font>
- Enable Voice Roaming<font color="#000000">\:</font> <font color="#000000">Turn on the ability to make voice calls when the device is roaming.</font>
- Found<font color="#000000">\:</font> <font color="#000000">Designate the selected lost device as found.</font>
- Install Downloaded OS Update<font color="#000000">\:</font>
- Install Help\@Work<font color="#000000">\:</font> <font color="#000000">Install the Help\@Work app.</font>
- Locate<font color="#000000">\:</font> <font color="#000000">Retrieve the last known location for the selected device.</font>
- Lock<font color="#000000">\: Force the selected device to require a passcode for user access.</font>
- Lost<font color="#000000">\:</font> <font color="#000000">Designate the selected device as lost.</font>
- Lost Mode<font color="#000000">\:</font> <font color="#000000">Prevents unauthorized access to the lost device and tracks the location of the device.</font>
- Ivanti Bridge<font color="#000000">\:</font> Create a configuration for the Bridge application for Windows 10 Management.
- Push Profile<font color="#000000">\:</font> <font color="#000000">Prompt a manual distribution of profiles to the selected device.</font>
- Re-provision Device<font color="#000000">\:</font> <font color="#000000">Restart the provisioning process for the selected device.</font>
- Reboot<font color="#000000">\:</font> Reboot the selected Windows device.
- Register Device<font color="#000000">\:</font> <font color="#000000">Start the registration process for the selected device.</font>
- Remote Control<font color="#000000">\:</font> <font color="#000000">Establish a remote control session (Help\@Work) on the selected Android device.</font>
- Remote Display<font color="#000000">\:</font> <font color="#000000">Establish a remote view session (Help\@Work) on the selected iOS device.</font>
- Remove Device Attribute<font color="#000000">\:</font> <font color="#000000">Remove an attribute from a device.</font>
- Remove Label<font color="#000000">\:</font> <font color="#000000">Remove the association between the specified label and the selected item.</font>
- Remove Multiple labels from one device<font color="#000000">\: Remove the association between the specified labels and the selected item.</font>
- Request Derived Credential: Device user request in user portal for a derived credential.
- <font color="#323232">Request Unlock AppConnect Container </font>(Android only):<font color="#323232"> </font>Initiate unlock AppConnect container.
- Request Unlock Device<font color="#000000">\:</font> <font color="#000000">Initiate unlock device.</font>
- Request Unlock Passcode<font color="#000000">\:</font> <font color="#000000">Initiate unlock passcode.</font>
- Resend Provision Message<font color="#000000">\:</font> <font color="#000000">No longer supported.</font>
- Reset AppConnect Passcode: Device user request in user portal to reset the AppConnect passcode.
- Reset Password<font color="#000000">\:</font>
- Restart iOS Device<font color="#000000">\:</font> <font color="#000000">Restart iOS device.</font>
- Reset PIN<font color="#000000">\:</font> <font color="#000000">Generate a new registration PIN for the selected Windows device.</font>
- Retire<font color="#000000">\:</font> <font color="#000000">End management of the selected device.</font>
- Send Activation Lock Bypass Code<font color="#000000">\:</font> <font color="#000000">Send the bypass code to the selected iOS device.</font>
- Send Alert<font color="#000000">\:</font> <font color="#000000">Send compliance alert to the selected device.</font>
- Send APNS message<font color="#000000">\:</font> <font color="#000000">Launch a client and authenticate against Ivanti EPMM.</font>
- Send Message<font color="#000000">\:</font> <font color="#000000">Send SMS message to the selected device.</font>
- Set Device Attribute: <font color="#000000">Set an attribute to a device.</font>
- Shutdown iOS Device<font color="#000000">\:</font> <font color="#000000">Shutdown iOS device.</font>
- Sign In<font color="#000000">\:</font> <font color="#000000">Launch a client and authenticate against Ivanti EPMM.</font>
- Sign Out<font color="#000000">\:</font> <font color="#000000">End session between the client and Ivanti EPMM.</font>
- Substitution Variable Change<font color="#000000">\:</font> Change a configuration due to a change in the value of a substitution variable.
- <font color="#323232">Unlock AppConnect Container </font>(Android only):<font color="#323232"> </font>Begin unlock device and AppConnect container.
- <font color="#323232">Unlock Device and AppConnect Container</font>: (Android only):<font color="#323232"> </font>Begin unlock device and AppConnect container.
- Unlock Device Only<font color="#000000">\:</font> <font color="#000000">Clear the passcode for the selected device.</font>
- Update Device Comment<font color="#000000">\:</font> <font color="#000000">Change the Comment field in the record for the selected device.</font>
- Update OS Software: Update iOS software.
- Wakeup<font color="#000000">\:</font> <font color="#000000">Force the device client to check in.</font>
- Windows License: Alert administrators to upgrade the SKU of Windows 10 desktop devices. Options can be Windows 10 Pro to Enterprise or Windows 10 Education to Enterprise.
- Wipe<font color="#000000">\:</font> <font color="#000000">Return the device to factory default settings.</font>

:::hint{type="info"}
Events beginning with <font color="#323232">Request</font>, such as <font color="#323232">Request Unlock Device</font>, are logged when an administrator clicks the corresponding command in the Admin Portal. The corresponding event without the word <font color="#323232">Request</font>, such as <font color="#323232">Unlock Device</font>, is logged when Ivanti EPMM actually sends the request to the device. Ivanti EPMM sometimes delays sending requests to regulate Ivanti EPMM performance.
:::

## ActiveSync Device information

These events do not apply to Mac devices.

To monitor ActiveSync device actions, select one or more of the logged ActiveSync device actions in the <font color="#323232">Filters</font> panel

- ActiveSync Device Comment<font color="#000000">\: Add or change the comment associated with an ActiveSync device entry.</font>
- Add Correlation:
- Allow Device<font color="#000000">\: Allow a blocked ActiveSync device to access the ActiveSync server.</font>
- Assign ActiveSync Policy<font color="#000000">\: Apply an ActiveSync policy to the selected device.</font>
- Block Device<font color="#000000">\: Prevent the selected device from accessing the ActiveSync server.</font>
- Link To MI Device<font color="#000000">\: Associate an ActiveSync device with a device registered with Ivanti EPMM.</font>
- Remove<font color="#000000">\: End the association between the Ivanti EPMM device and the ActiveSync device record.</font>
- Remove Correlation:
- Revert ActiveSync Policy<font color="#000000">\: Restore the Default ActiveSync Policy to the selected device.</font>

## MDM events

MDM events indicate when a device takes an action due to an Ivanti EPMM request. These events pertain only to iOS and Mac devices unless otherwise noted.

To monitor these actions, select one or more of the logged MDM actions in the <font color="#323232">Filters</font> panel.

- Apply Redemption Code<font color="#000000">\: Apply Redemption Code\: Use a Apple License code.</font>
- Clear Passcode<font color="#000000">\: Clear Passcode\: Reset device passcode.</font>
- Device Lock<font color="#000000">\: Set screen lock on device.</font>
- Install Encrypted Sub-Profile:
- Install Managed Application<font color="#000000">\: Install a managed app.</font>
- Install MDM Profile<font color="#000000">\: Install the MDM profile on the device.</font>
- Install Provisioning Profile<font color="#000000">\: Install the provisioning profile for a managed app.</font>
- Lock Device (Android)<font color="#000000">\:</font><font color="#000000"> Lock an Android device.</font>
- Profile Change<font color="#000000">\: Change the profile on an iOS or Android device.</font>
- Remove Encrypted Sub-Profile:
- Remove Managed Application<font color="#000000">\: Uninstall a managed app.</font>
- Remove MDM Profile<font color="#000000">\: Remove the MDM profile from the device.</font>
- Remove Provisioning Profile<font color="#000000">\: Remove the provisioning profile for a managed app.</font>
- Settings<font color="#000000">\: Modify device settings.</font>
- Unlock Device (Android)<font color="#000000">\: Unlock an Android device and the AppConnect container on the device.</font>
- Unlock Device Only (Android)<font color="#000000">\: Unlock an Android device.</font>
- <font color="#323232">Wipe Device </font>(called <font color="#323232">Erase Device</font> in the <font color="#323232">MDM Activity</font> tab): Restore the iOS device to factory defaults.
- <font color="#323232">Wipe Device (Android)</font>: Restore the Android device to factory defaults.

:::hint{type="info"}
This MDM log information is also provided in the<font color="#323232"> Logs &gt; MDM Activity</font> tab.
:::

## Certificate events

To monitor actions involving certificates, select one or more of the logged certificate actions in the <font color="#323232">Filters</font> panel.

- Apply User Provided Certificate<font color="#000000">\: Use a certificate already provided by the user and sent to Ivanti EPMM.</font>
- Create Device Certificate<font color="#000000">\: Issue a device certificate.</font>
- Create User Certificate<font color="#000000">\: Issue a user certificate.</font>
- Delete User Provided Certificate<font color="#000000">\: Destroy certificate provided by the user via the self-service portal.</font>
- Device Certificate Expired<font color="#000000">\: Warn on a device certificate that is no longer valid due to expiration.</font>
- Device Certificate Renewal<font color="#000000">\: Re-enrolls a device certificate.</font>
- Reuse Device Certificate<font color="#000000">\: Use an existing device certificate.</font>
- Reuse User Certificate<font color="#000000">\: Use an existing user certificate.</font>
- Revoke Device Certificate<font color="#000000">\: Reclaim a device certificate.</font>
- Revoke User Certificate<font color="#000000">\: Reclaim a user certificate.</font>
- Upload User Provided Certificate<font color="#000000">\: Send certificate provided by the user via the self-service portal.</font>
- User Certificate Expired<font color="#000000">\: Warn on a user certificate that is no longer valid due to expiration.</font>
- User Certificate Renewal<font color="#000000">\: Re-enroll a user certificate.</font>

:::hint{type="info"}
The contents of the **Logs > Certificate Management** shows information about certificates, such as their expiration dates. It allows you to take actions, such as re-enroll, remove, and revoke on the certificates.
:::

## App Tunnel events

To monitor actions involving app tunnels, select one or more of the logged app tunnel actions in the <font color="#323232">Filters</font> panel.

- Allow App Tunnel<font color="#000000">\: Permit the specified app tunnel.</font>
- App Tunnel Comment<font color="#000000">\: Add a comment on the selected app tunnel.</font>
- Block App Tunnel<font color="#000000">\: Do not allow the specified app tunnel.</font>
- Remove App Tunnel<font color="#000000">\: Delete the selected app tunnel configuration.</font>