Access log use cases and workflows (ADPP add-on)

<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>
<div class="article-banner" id="addon_adpp">
<table>
<tbody>
<tr>
<td>
<strong>Add-on</strong>
</td>
<td>Advanced Data Privacy and Protection (ADPP)</td>
</tr>
</tbody>
</table>
</div>
</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Verified AI summary <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">Use the access log to monitor agent activity, ensuring data privacy and security. Identify unauthorized access, track changes to user data, and prevent potential security risks by filtering access events. Secure API credentials, control access, and detect suspicious activities to maintain compliance and safeguard sensitive information. Leverage both the Admin Center and API workflows for comprehensive oversight.</p>
</div>
<div class="body">
<div class="note fastpath" id="ac_security_access_log_overview__note_enz_qfm_rdc">
<span class="fastpathtitle">Location: </span> <span class="ph">Admin Center &gt; Account &gt; Logs &gt; Access log</span>
</div>
<p class="p">As described in <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/6066010357530" target="_blank">Using the access log to monitor agent
activity</a>, the access log enables monitoring of access events in your account
related to tickets, user profiles, and searches. By providing detailed, filtered views
of access events, admins and <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408882153882" target="_blank">agents with permission</a> can identify unauthorized activities
and help ensure compliance with data privacy regulations. </p>
<div class="p">This article covers the following topics:<ul class="ul" id="ac_security_access_log_overview__ul_bmm_psq_kwb">
<li class="li"><a class="xref" href="#topic_nxr_yxr_jhc">Common use cases</a></li>
<li class="li"><a class="xref" href="#topic_zgr_tzr_jhc">Example Admin Center workflows</a></li>
<li class="li"><a class="xref" href="#topic_r3v_xzr_jhc">Example API workflows</a></li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_nxr_yxr_jhc">
<h2 class="title topictitle2" id="ariaid-title2">Common use cases</h2>
<div class="body">
<p class="p">This section includes example use cases to help you better understand how the access
log can aid in detecting potential security risks. These use cases apply to both the
Admin Center user interface and the API.</p>
<p class="p">Each use case includes categories and summaries to filter the access log and find
related access events. For example, in the use case <em class="ph i">Monitor changes to contact
numbers to prevent abuse or fraud</em>, filter by the <strong class="ph b">Phone numbers</strong>
Category and the recommended Summary items (such as <strong class="ph b">Create Phone Number</strong> and
<strong class="ph b">Delete Phone Number</strong>) to surface the related access events.</p>
<p class="p"><img class="image img-screenshot" id="topic_nxr_yxr_jhc__image_zhz_gh4_mhc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/access_log_filter_example.png" width="300"></p>
<div class="p">For more information on filtering the access log, see the following topics:<ul class="ul" id="topic_nxr_yxr_jhc__ul_ezq_sj1_nhc">
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/6066010357530#topic_mdl_fy5_3hc" target="_blank">Filtering access log data to refine
search results</a></li>
<li class="li"><a class="xref" href="https://developer.zendesk.com/api-reference/ticketing/account-configuration/access_logs/" target="_blank">Zendesk API Reference: Access
Logs</a></li>
</ul>
</div>
<p class="p">Expand the sections below to learn more about common use cases.</p>
<div class="div accordion">
<p class="p"><strong class="ph b">Monitor user data access and assess privacy risks</strong></p>
</div>
<div class="div panel">
<div class="tablenoborder">
<table border="1" cellpadding="4" cellspacing="0" class="table" dir="ltr" frame="border" id="topic_nxr_yxr_jhc__table_cqq_jks_mhc" rules="all" summary="">
<colgroup>
<col style="width:30.749354005167962%">
<col style="width:32.04134366925065%">
<col style="width:37.2093023255814%">
</colgroup>
<thead class="thead" style="text-align:left;">
<tr class="row">
<th class="entry nocellnorowborder" id="d89e128" style="vertical-align:top;">Use case</th>
<th class="entry nocellnorowborder" id="d89e131" style="vertical-align:top;">Category filter</th>
<th class="entry cell-norowborder" id="d89e134" style="vertical-align:top;">Summary filters</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e128" rowspan="2" style="vertical-align:top;">Monitor user profile views to detect unauthorized or
excessive profile data access</td>
<td class="entry nocellnorowborder" headers="d89e131" style="vertical-align:top;">Users</td>
<td class="entry cell-norowborder" headers="d89e134" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_os3_4ht_mhc">
<li class="li">Show user</li>
<li class="li">List users</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e131" style="vertical-align:top;">Profiles API</td>
<td class="entry cell-norowborder" headers="d89e134" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_n3w_qns_mhc">
<li class="li">Get profile by identifier</li>
<li class="li">Get profile by profile ID</li>
<li class="li">Get profiles by user ID</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e128" rowspan="2" style="vertical-align:top;">Monitor critical security settings and account
configuration changes</td>
<td class="entry nocellnorowborder" headers="d89e131" style="vertical-align:top;">Account settings</td>
<td class="entry cell-norowborder" headers="d89e134" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_zy3_swn_nhc">
<li class="li">Update account settings</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e131" style="vertical-align:top;">Staff</td>
<td class="entry cell-norowborder" headers="d89e134" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_qrm_tns_mhc">
<li class="li">Fetch staff users</li>
<li class="li">Update staff user</li>
<li class="li">Change password</li>
<li class="li">Update email identity</li>
<li class="li">Fetch 2FA recovery code</li>
<li class="li">Delete 2FA configuration</li>
<li class="li">Set password</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e128" rowspan="3" style="vertical-align:top;">Track changes to authentication vectors indicating
possible account compromise</td>
<td class="entry nocellnorowborder" headers="d89e131" style="vertical-align:top;">User identities</td>
<td class="entry cell-norowborder" headers="d89e134" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_v5f_43t_mhc">
<li class="li">List identities</li>
<li class="li">Delete identity</li>
<li class="li">Show identity</li>
<li class="li">Make identity primary</li>
<li class="li">Update identity</li>
<li class="li">Create identity</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e131" style="vertical-align:top;">Current account</td>
<td class="entry cell-norowborder" headers="d89e134" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_izn_s3t_mhc">
<li class="li">Returns remote authentications for the account</li>
<li class="li">Delete a remote authentication by ID</li>
<li class="li">Get a remote authentication by ID</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e131" style="vertical-align:top;">Remote authentication</td>
<td class="entry cell-norowborder" headers="d89e134" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_rrk_v3t_mhc">
<li class="li">Update a remote authentication</li>
<li class="li">Creates a new remote authentication</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e128" style="vertical-align:top;">Monitor changes to contact numbers to prevent abuse or
fraud</td>
<td class="entry nocellnorowborder" headers="d89e131" style="vertical-align:top;">Phone numbers</td>
<td class="entry cell-norowborder" headers="d89e134" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_mnp_1jt_mhc">
<li class="li">List phone numbers</li>
<li class="li">Delete phone number</li>
<li class="li">Show phone number</li>
<li class="li">Update phone number</li>
<li class="li">Create phone number</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e128" rowspan="2" style="vertical-align:top;">Monitor custom object data and workflow rules to
prevent data breaches</td>
<td class="entry nocellnorowborder" headers="d89e131" style="vertical-align:top;">Custom objects</td>
<td class="entry cell-norowborder" headers="d89e134" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_lx3_2jt_mhc">
<li class="li">List custom objects</li>
<li class="li">Delete custom object</li>
<li class="li">Show custom object</li>
<li class="li">Update custom object</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry row-nocellborder" headers="d89e131" style="vertical-align:top;">Custom object fields</td>
<td class="entry cellrowborder" headers="d89e134" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_q5q_hjt_mhc">
<li class="li">List custom object fields</li>
<li class="li">Delete custom object field</li>
<li class="li">Show custom object field</li>
<li class="li">Update custom object field</li>
<li class="li">Create custom object field</li>
</ul>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="div accordion">
<p class="p"><strong class="ph b">Secure API credentials and tokens</strong></p>
</div>
<div class="div panel">
<div class="tablenoborder">
<table border="1" cellpadding="4" cellspacing="0" class="table" dir="ltr" frame="border" id="topic_nxr_yxr_jhc__table_zqr_lls_mhc" rules="all" summary="">
<colgroup>
<col style="width:30.749354005167962%">
<col style="width:32.04134366925065%">
<col style="width:37.2093023255814%">
</colgroup>
<thead class="thead" style="text-align:left;">
<tr class="row">
<th class="entry nocellnorowborder" id="d89e420" style="vertical-align:top;">Use case</th>
<th class="entry nocellnorowborder" id="d89e423" style="vertical-align:top;">Category filter</th>
<th class="entry cell-norowborder" id="d89e426" style="vertical-align:top;">Summary filters</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e420" rowspan="3" style="vertical-align:top;">Secure API credentials and tokens to prevent
unauthorized API access</td>
<td class="entry nocellnorowborder" headers="d89e423" style="vertical-align:top;">OAuth tokens</td>
<td class="entry cell-norowborder" headers="d89e426" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_lmz_tjt_mhc">
<li class="li">List tokens</li>
<li class="li">Revoke token</li>
<li class="li">Show token</li>
<li class="li">Create token</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e423" style="vertical-align:top;">OAuth clients</td>
<td class="entry cell-norowborder" headers="d89e426" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_bbs_wjt_mhc">
<li class="li">Show OAuth clients</li>
<li class="li">Delete OAuth client</li>
<li class="li">Show OAuth client</li>
<li class="li">Update OAuth client</li>
<li class="li">Create OAuth client</li>
<li class="li">List clients</li>
<li class="li">Delete client</li>
<li class="li">Show client</li>
<li class="li">Update client</li>
<li class="li">Create client</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e423" style="vertical-align:top;">OAuth connections</td>
<td class="entry cell-norowborder" headers="d89e426" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_rjc_l4t_mhc">
<li class="li">Delete connection</li>
<li class="li">Show OAuth connection</li>
<li class="li">Update connection</li>
<li class="li">Create connection</li>
<li class="li">Import connection</li>
<li class="li">Exchange verification code</li>
<li class="li">OAuth callback</li>
<li class="li">Show OAuth flow</li>
<li class="li">Start OAuth flow</li>
<li class="li">Start OAuth redirect</li>
<li class="li">OAuth token</li>
<li class="li">Refresh OAuth token</li>
<li class="li">Show OAuth connections</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e420" rowspan="2" style="vertical-align:top;">Monitor API keys and basic authentication
credentials management for abuse prevention</td>
<td class="entry nocellnorowborder" headers="d89e423" style="vertical-align:top;">API key connections</td>
<td class="entry cell-norowborder" headers="d89e426" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_htv_s4t_mhc">
<li class="li">Delete API key connection</li>
<li class="li">Update API key connection</li>
<li class="li">Create API key connection</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry row-nocellborder" headers="d89e423" style="vertical-align:top;">Basic authentication connections</td>
<td class="entry cellrowborder" headers="d89e426" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_flw_v4t_mhc">
<li class="li">Delete basic authentication connection</li>
<li class="li">Update basic authentication connection</li>
<li class="li">Create basic authentication connection</li>
</ul>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="div accordion">
<p class="p"><strong class="ph b">Assess security risks for apps, integrations, and automations</strong></p>
</div>
<div class="div panel">
<div class="tablenoborder">
<table border="1" cellpadding="4" cellspacing="0" class="table" dir="ltr" frame="border" id="topic_nxr_yxr_jhc__table_zjl_rls_mhc" rules="all" summary="">
<colgroup>
<col style="width:30.749354005167962%">
<col style="width:32.04134366925065%">
<col style="width:37.2093023255814%">
</colgroup>
<thead class="thead" style="text-align:left;">
<tr class="row">
<th class="entry nocellnorowborder" id="d89e628" style="vertical-align:top;">Use case</th>
<th class="entry nocellnorowborder" id="d89e631" style="vertical-align:top;">Category filter</th>
<th class="entry cell-norowborder" id="d89e634" style="vertical-align:top;">Summary filters</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e628" rowspan="3" style="vertical-align:top;">Monitor app and integration lifecycle changes to
help prevent security risks</td>
<td class="entry nocellnorowborder" headers="d89e631" style="vertical-align:top;">Apps</td>
<td class="entry cell-norowborder" headers="d89e634" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_vtz_1pt_mhc">
<li class="li">Delete app</li>
<li class="li">Get app public key</li>
<li class="li">Update app</li>
<li class="li">Update app installation</li>
<li class="li">Install app</li>
<li class="li">Create app</li>
<li class="li">Upload app package</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e631" style="vertical-align:top;">Installations</td>
<td class="entry cell-norowborder" headers="d89e634" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_vxl_2pt_mhc">
<li class="li">Update installed integration</li>
<li class="li">Create an installation</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e631" style="vertical-align:top;">Integrations</td>
<td class="entry cell-norowborder" headers="d89e634" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_ihj_gpt_mhc">
<li class="li">Create integration</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e628" style="vertical-align:top;">Prevent webhook management abuse, such as data exfiltration
or automation-based attacks</td>
<td class="entry nocellnorowborder" headers="d89e631" style="vertical-align:top;">Webhooks</td>
<td class="entry cell-norowborder" headers="d89e634" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_k25_3pt_mhc">
<li class="li">Delete webhook</li>
<li class="li">List webhook invocations</li>
<li class="li">List webhook invocation attempts</li>
<li class="li">Patch webhook</li>
<li class="li">Update webhook</li>
<li class="li">Show webhook signing secret</li>
<li class="li">Reset webhook signing secret</li>
<li class="li">Create or clone webhook</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e628" rowspan="4" style="vertical-align:top;">Detect automation misuse to prevent privilege
escalation or data leaks</td>
<td class="entry nocellnorowborder" headers="d89e631" style="vertical-align:top;">Automations</td>
<td class="entry cell-norowborder" headers="d89e634" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_dvk_ptt_mhc">
<li class="li">Bulk delete automations</li>
<li class="li">Delete automation</li>
<li class="li">Update automation</li>
<li class="li">Create automation</li>
<li class="li">Update many automations</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e631" style="vertical-align:top;">Macros</td>
<td class="entry cell-norowborder" headers="d89e634" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_z4t_rtt_mhc">
<li class="li">Create unassociated macro attachment</li>
<li class="li">Bulk delete macros</li>
<li class="li">Create macro attachment</li>
<li class="li">Delete macro</li>
<li class="li">Update macro</li>
<li class="li">Create macro</li>
<li class="li">Update many macros</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e631" style="vertical-align:top;">Object triggers</td>
<td class="entry cell-norowborder" headers="d89e634" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_pq4_vtt_mhc">
<li class="li">Delete many object triggers</li>
<li class="li">Delete object trigger</li>
<li class="li">Update object trigger</li>
<li class="li">Create object trigger</li>
<li class="li">Update many object triggers</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry row-nocellborder" headers="d89e631" style="vertical-align:top;">Triggers</td>
<td class="entry cellrowborder" headers="d89e634" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_fh3_ytt_mhc">
<li class="li">Bulk delete ticket triggers</li>
<li class="li">Delete ticket trigger</li>
<li class="li">Update ticket trigger</li>
<li class="li">Create trigger</li>
<li class="li">Update many ticket triggers</li>
</ul>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="div accordion">
<p class="p"><strong class="ph b">Control access and prevent privilege escalation</strong></p>
</div>
<div class="div panel">
<div class="tablenoborder">
<table border="1" cellpadding="4" cellspacing="0" class="table" dir="ltr" frame="border" id="topic_nxr_yxr_jhc__table_vny_vls_mhc" rules="all" summary="">
<colgroup>
<col style="width:30.749354005167962%">
<col style="width:32.04134366925065%">
<col style="width:37.2093023255814%">
</colgroup>
<thead class="thead" style="text-align:left;">
<tr class="row">
<th class="entry nocellnorowborder" id="d89e898" style="vertical-align:top;">Use case</th>
<th class="entry nocellnorowborder" id="d89e901" style="vertical-align:top;">Category filter</th>
<th class="entry cell-norowborder" id="d89e904" style="vertical-align:top;">Summary filters</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e898" rowspan="2" style="vertical-align:top;">Prevent unauthorized privilege escalation by
tracking group and role changes</td>
<td class="entry nocellnorowborder" headers="d89e901" style="vertical-align:top;">Group memberships</td>
<td class="entry cell-norowborder" headers="d89e904" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_a3d_25t_mhc">
<li class="li">Bulk create memberships</li>
<li class="li">Bulk delete memberships</li>
<li class="li">Delete membership</li>
<li class="li">Create membership</li>
</ul>
</td>
</tr>
<tr class="row">
<td class="entry row-nocellborder" headers="d89e901" style="vertical-align:top;">Custom roles</td>
<td class="entry cellrowborder" headers="d89e904" style="vertical-align:top;">
<ul class="ul" id="topic_nxr_yxr_jhc__ul_w1z_h5t_mhc">
<li class="li">Delete custom role</li>
<li class="li">Update custom role</li>
<li class="li">Create custom role</li>
</ul>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="div accordion">
<p class="p"><strong class="ph b">Detect bulk actions that could signify malicious activity</strong></p>
</div>
<div class="div panel">
<div class="tablenoborder">
<table border="1" cellpadding="4" cellspacing="0" class="table" dir="ltr" frame="border" id="topic_nxr_yxr_jhc__table_d2j_bms_mhc" rules="all" summary="">
<colgroup>
<col style="width:30.749354005167962%">
<col style="width:32.04134366925065%">
<col style="width:37.2093023255814%">
</colgroup>
<thead class="thead" style="text-align:left;">
<tr class="row">
<th class="entry nocellnorowborder" id="d89e986" style="vertical-align:top;">Use case</th>
<th class="entry nocellnorowborder" id="d89e989" style="vertical-align:top;">Category filter</th>
<th class="entry cell-norowborder" id="d89e992" style="vertical-align:top;">Summary filter</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e986" rowspan="7" style="vertical-align:top;">Detect other high-impact mass operations that
could signify malicious activity</td>
<td class="entry nocellnorowborder" headers="d89e989" style="vertical-align:top;">Organization memberships</td>
<td class="entry cell-norowborder" headers="d89e992" style="vertical-align:top;">Bulk delete memberships</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e989" style="vertical-align:top;">Organizations</td>
<td class="entry cell-norowborder" headers="d89e992" style="vertical-align:top;">Bulk delete organizations</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e989" style="vertical-align:top;">Sessions</td>
<td class="entry cell-norowborder" headers="d89e992" style="vertical-align:top;">Bulk delete sessions</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e989" style="vertical-align:top;">Tickets</td>
<td class="entry cell-norowborder" headers="d89e992" style="vertical-align:top;">Bulk delete tickets</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e989" style="vertical-align:top;">Users</td>
<td class="entry cell-norowborder" headers="d89e992" style="vertical-align:top;">Bulk delete users</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e989" style="vertical-align:top;">Views</td>
<td class="entry cell-norowborder" headers="d89e992" style="vertical-align:top;">Bulk delete views</td>
</tr>
<tr class="row">
<td class="entry row-nocellborder" headers="d89e989" style="vertical-align:top;">Workspaces</td>
<td class="entry cellrowborder" headers="d89e992" style="vertical-align:top;">Bulk delete workspaces</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_zgr_tzr_jhc">
<h2 class="title topictitle2" id="ariaid-title3">Example Admin Center workflows</h2>
<div aria-labelledby="ariaid-title4" class="topic nested2" id="topic_gj3_5qv_3hc">
<h3 class="title topictitle3" id="ariaid-title4">Monitor user profile views to detect unauthorized or excessive access</h3>
<div class="body">
<p class="p"><strong class="ph b">Scenario</strong>: As an admin, you want to ensure agents can only view customer
profiles within their groups. </p>
<div class="p">
<strong class="ph b">How to use the access log to filter these access events:</strong><ol class="ol" id="topic_gj3_5qv_3hc__ol_p2v_3gs_jhc">
<li class="li"><span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_gj3_5qv_3hc__d9e475" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Logs &gt; Access log</strong>.</span></li>
<li class="li">Click <strong class="ph b">Filter</strong>.</li>
<li class="li">Apply either of the following activity filter combinations:<ul class="ul" id="topic_gj3_5qv_3hc__ul_q2v_3gs_jhc">
<li class="li">
<strong class="ph b">Category</strong>: Users, <strong class="ph b">Summary</strong>: Show user, List
users</li>
<li class="li">
<strong class="ph b">Category</strong>: Profiles API, <strong class="ph b">Summary</strong>: Get profile by
identifier, Get profile by profile ID, Get profiles by user
ID</li>
</ul>
</li>
<li class="li">Click <strong class="ph b">Apply filters</strong>.</li>
<li class="li">Review the list of events for unauthorized profile views.</li>
</ol>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title5" class="topic nested2" id="topic_abd_w2m_jhc">
<h3 class="title topictitle3" id="ariaid-title5">Monitor critical security settings and account configuration changes </h3>
<div class="body">
<p class="p"><strong class="ph b">Scenario:</strong> As an admin, you want to monitor when other Zendesk admins
change critical security and account settings to ensure your account remains
secure and compliant.</p>
<div class="p">
<strong class="ph b">How to use the access log to filter these access events:</strong><ol class="ol" id="topic_abd_w2m_jhc__ol_j1y_z3t_jsb">
<li class="li"><span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_abd_w2m_jhc__d9e475" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Logs &gt; Access log</strong>.</span></li>
<li class="li">Click <strong class="ph b">Filter</strong>.</li>
<li class="li">Apply either of the following activity filter combinations:<ul class="ul" id="topic_abd_w2m_jhc__ul_irr_bhl_jhc">
<li class="li">
<strong class="ph b">Category</strong>: Account settings, <strong class="ph b">Summary</strong>: Update
account settings</li>
<li class="li">
<strong class="ph b">Category</strong>: Staff, <strong class="ph b">Summary</strong>: Fetch staff users,
Update staff user, Change password, Update email identity, Fetch
2FA recovery code, Delete 2FA configuration, Set password</li>
</ul>
</li>
<li class="li">Click <strong class="ph b">Apply filters</strong>.</li>
<li class="li">Review the list for security settings or account configuration updates
that put your account at risk.</li>
</ol>
</div>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title6" class="topic nested1" id="topic_r3v_xzr_jhc">
<h2 class="title topictitle2" id="ariaid-title6">Example API workflows</h2>
<div aria-labelledby="ariaid-title7" class="topic nested2" id="topic_gnh_wph_xyb">
<h3 class="title topictitle3" id="ariaid-title7">Identify trends to help refine permissions</h3>
<div class="body">
<p class="p"><strong class="ph b">Scenario</strong>: Your company has a new customer service team, and you want to
ensure its agents are viewing the correct data to comply with data privacy
regulations. Your goal is to refine permissions for this group so agents have
access only to the data they are permitted to see.</p>
<p class="p"><strong class="ph b">How to use the Access Log API to address the scenario:</strong></p>
<ol class="ol" id="topic_gnh_wph_xyb__ol_g3v_2bl_jhc">
<li class="li">Identify an agent of the new team to use their activity as a reference
point.</li>
<li class="li">Make an API call filtered by the agent's user ID, which reveals all of the
agent's events, including a record of the tickets viewed and searches, at
what time, and from which IP address.<p class="p">For example, user_id 1213456789
viewed ticket number
937.</p>
<pre class="pre codeblock" id="topic_gnh_wph_xyb__codeblock_xds_xdn_xyb"><code>timestamp: "2023-02-16T19:00:00Z",
user_id: 1213456789,
ip_address: "00.00.000.00",
url: ""/api/v2/tickets/937?[...]
method: "GET",
status: 200</code></pre>
<p class="p">Also, user_id 1213456789 opened the profile
belonging to user_id
9878654.</p>
<pre class="pre codeblock" id="topic_gnh_wph_xyb__codeblock_xcg_b2n_xyb"><code>timestamp: “2023-02-16T19:00:00Z”,
user_id: 1213456789,
ip_address: “00.00.000.00”,
url: “/api/v2/users/9878654?[...]
method: “GET”,
status: 304
</code></pre>
</li>
<li class="li">Use the data to determine whether the agent is accessing tickets assigned to
other agent groups or viewing profiles of customers assigned to other
agents. <p class="p">You now have more data to help you set up the proper permissions
for agents in the group.</p>
</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title8" class="topic nested2" id="topic_jqx_v1j_jhc">
<h3 class="title topictitle3" id="ariaid-title8">Investigate suspicious activity</h3>
<div class="body">
<p class="p"><strong class="ph b">Scenario</strong>: You are notified that an agent is searching for customer credit
card numbers. You'd like a complete record of the agent's activity so you can
take the appropriate steps to investigate the issue.</p>
<p class="p"><strong class="ph b">How to use the Access Log API to address the scenario:</strong></p>
<ol class="ol" id="topic_jqx_v1j_jhc__ol_vbw_h2l_jhc">
<li class="li">Make an API call filtered by the agent's user ID.</li>
<li class="li">Evaluate the search records in the access log to identify repeated searches
for sensitive information.<p class="p">For example, this agent is searching for
"credit
card."</p>
<pre class="pre codeblock" id="topic_jqx_v1j_jhc__codeblock_lvd_3fn_xyb"><code>timestamp: “2023-02-16T19:00:00Z”,
user_id: 1213456789,
ip_address: “00.00.000.00”,
url: “/hc/api/v2/articles/search.json?[...]query=credit%20card”,
method: “GET”,
status: 200
</code></pre>
</li>
<li class="li">If applicable, use the access log to help trace which customers have been
affected. </li>
</ol>
</div>
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/9972142485530",
"url": "https://support.zendesk.com/hc/en-us/articles/9972142485530-Access-log-use-cases-and-workflows-ADPP-add-on",
"headline": "Access log use cases and workflows (ADPP add-on)",
"description": "You can use the access log to monitor and filter account access events, detect unauthorized activities, and assess security risks to maintain data privacy and compliance through both user interface and API workflows.",
"articleSection": "Protecting your customer's data",
"datePublished": "2025-11-21T03:19:28+00:00",
"dateModified": "2026-02-04T20:55:35+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/9972142485530"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"@id": "https://support.zendesk.com/hc/"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk",
"@id": "https://www.zendesk.com",
"softwareAddOn": {
"@type": "SoftwareApplication",
"name": "Security",
"@id": "https://support.zendesk.com/hc/en-us/sections/9641715451034"
}
}
}</script><script id="fast-path-script">
//<![CDATA[
const fast_path_style = document.createElement('style');
fast_path_style.innerHTML = `#article-body .fastpath{font-size:.9em;background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 8px;margin-bottom:16px}#article-body .fastpath::before{content:none!important}`;
document.head.appendChild(fast_path_style);
//]]>
</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>