See Who Changed What, and What It Looked Like Before
November 3, 2026 · InfraScout Team
An MCP server now points at a different URL. An agent group has three more members than last week. The default AI connection runs on another model. Until now, InfraScout could tell you what the AI ran on your hosts, but not who changed these settings or what they were before. The new audit trail answers both questions.
Who, when, how, and what changed
Open Admin → Audit & Compliance → Events. Every entry names the actor, the time, the object, the action and whether it worked, and the detail panel shows a Before and After table of exactly the fields that changed. A deleted object keeps its name in the trail, so you can still read what it was.
The trail covers configuration changes across the admin area: agents, agent groups and policies, enrollment keys, MCP servers, AI provider and Entra connections, workflows and schedules, service accounts, tool groups, command policies, visibility, playbooks and memory files. It also records admin operations such as approving agents, revoking certificates, forcing updates, and testing or syncing connections, even when they change nothing.
Each entry's Channel tells you whether it came from the portal, a connected MCP client, a chat or an agentic workflow. Changes with no person behind them, such as an agent enrolling itself, a scheduled workflow run or an automatic update rollout, carry a System or Workflow actor, so you can tell people and automation apart at a glance.
Chats appear too, without their content. Creating, renaming, moving and deleting a conversation is recorded, while messages and attachments are not. The commands the AI runs on your hosts stay in the Executions trail, where they have always been.
Sensitive changes are never made unrecorded
For the actions that matter most, the entry is written before the change happens. These are revoking or force-renewing an agent's certificate from the admin area, revoking an enrollment key or the agents enrolled with it, changing a command policy or an agent update policy, creating or deleting a workflow's webhook, changing who can see a resource, and rotating your tenant's data encryption key. If InfraScout cannot write the entry first, it refuses the change, and you can simply try again a moment later.
That guarantee comes with a requirement. Command policies and visibility settings now have a size limit when you save them, so the whole change always fits in its entry. The limits are generous for anything written by hand; the Audit Events page lists them.
A trail you can rely on
Entries are kept for 180 days. Nobody can edit or delete them through InfraScout, admins included. Secrets such as API keys, client secrets and tokens never reach an entry: when one changes, the trail shows that it changed and hides the value. Only admins of your tenant can read the trail.
One thing to keep in mind: text you type into an ordinary field, such as a description or an MCP server's command arguments, is recorded as written. Keep credentials in the secret fields built for them.
Finding the change you are looking for
Filter by actor, outcome, resource type, resource ID or action, or search for a resource or person by name, over the last 24 hours, 7 or 30 days, or a custom range. Failed attempts are recorded with their error, and a loop of identical failures collapses into a single entry with a repeat count. New entries appear live at the top of the list.
The Audit Events page walks through every filter, column and field in the detail panel.