How do I find out who changed permissions on a Confluence Cloud space?

[Nancy Wilson]

Someone removed anonymous view access from our customer-facing documentation.  Does Jira log this kind of activity?  Nothing is obvious to me (Site Admin) when searching the System  Audit Log.

[Darryl Lee · Accepted solution]

Hi Nancy --

That should be in the Confluence Audit Log. There's details on how to get to it here:

https://support.atlassian.com/confluence-cloud/docs/view-the-audit-log/

[Nancy Wilson]

Hi,

Thanks, yes, I had already reviewed the logs, but what IDs a space permission update?  What would you filter on or search for?  Filtering on permissions doesn't return the level of detail required to see who updated Confluence Cloud space settings.

For example:

OPERATION DETAILS:

Date:

01/Dec/22 10:00 AM (GMT+5) Asia/Kolkata

IP:

27.122.61.219

Type:

Application access

Permission:

The change I'm trying to track down involved disabling anonymous access to our public documentation space.

A search on `anonymous` returned: 

`GlobalCustomerAccessSettings{globalCustomerAccessPermission=INVITE_ONLY, anonymousAccessEnabled=false}`

but that should have affected Jira Service Desk access only, right? Disabling anonymous access to a space that formerly had it enabled would require an explicit action AFAIK.  Other open spaces weren't affected.

[Darryl Lee]

Hi @Nancy Wilson - so I'm assuming your customer-facing documentation is in Confluence. Would that be correct?

What you included looks like it's from Jira audit logs, not Confluence.

Here's what a link to the logs in Confluence looks like: https://YOURSITE.atlassian.net/wiki/admin/auditlogging.action

And here's what it looked like in my logs when I ADDED anonymous access to one of my Confluence spaces:

So you ought to be able to find something similar for Removal of that permission in your Confluence logs. Let us know!

[Nancy Wilson]

Ah, you're right!  Thanks for the correction.  Found it :-)

[Darryl Lee]

Glad you found it! Would you mind please clicking the [Accept Answer] button up at the top of this  page? Thanks!