Admin Action Log in the Quip Admin Console

Accessing the Admin Action Log

To open the Admin Action Log:

1. Open the Quip Admin Console.
2. Navigate to Admin Action Log in the left sidebar.

The log displays entries in reverse chronological order — the most recent actions appear at the top.

What Is Logged

The Admin Action Log records the following types of actions:

• User management: Inviting, activating, deactivating, and resetting MFA for site members
• SSO configuration: Creating, updating, enabling, and disabling SAML configurations
• Security settings: Enabling or disabling antivirus scanning, legal hold, and DLP settings
• API key management: Creating and revoking API keys
• Domain settings: Adding or removing trusted domains
• Site settings: Changing the company name, subdomain, or banner message

Each log entry includes the date and time of the action, the administrator who performed it, and a description of what was changed.

Example: A company's security team discovers that SSO was briefly disabled and re-enabled on a Tuesday morning. They open the Admin Action Log and see exactly which administrator made the change at what time — useful for confirming whether it was authorized maintenance or an unauthorized configuration change.

Filtering the Log

Use the date range selector and search field at the top of the log to filter entries by time period or keyword. This helps narrow down a specific incident without scrolling through the entire history.

Log Retention

The Admin Action Log retains entries for at least 90 days. For longer retention requirements, export the log data regularly. To export, click the Export button to download the log as a CSV file.