# How to achieve tenant-wide audit logging beyond Delegated Admin Extension? **URL:** \ **Category:** Get Help\ **Tags:** logs, management-api\ **Created:** [September 25, 2025, 10:59am UTC](https://community.auth0.com/t/how-to-achieve-tenant-wide-audit-logging-beyond-delegated-admin-extension/192395 "2025-09-25T10:59:32Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![vitor.fernandes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/vitor.fernandes/32/71837_2.png) [@vitor.fernandes](https://community.auth0.com/u/vitor.fernandes)\ **Post date:** [September 25, 2025, 10:59am UTC](https://community.auth0.com/t/how-to-achieve-tenant-wide-audit-logging-beyond-delegated-admin-extension/192395/1 "2025-09-25T10:59:33Z")
Continuing the discussion from [Why are user\_name fields N/A in Api\_operation logs?](https://community.auth0.com/t/why-are-user-name-fields-n-a-in-api-operation-logs/191504): With proposed solution using Delegate Admin Extension, it does not solve my problem due it’s limitations: - **Scoped to organizations, not the entire tenant**. Our use case is broader: we need tenant-wide auditability. - Captures **actions performed in the extension only**. Actions made via API or dashboard outside the extension are not covered. - Introduces **additional complexity** in setup, management, and user flow. - Does not log **organization-level configuration changes** (e.g., modifying organization settings). **Example gaps we’re seeing today in Auth0 logs:** - When a **user is removed** from the tenant, the logs only show _who performed the removal_, not _which user was removed_. - When a **role is removed** from a user, the logs do not indicate _which role_ was removed, only _who initiated the action_. - When an **invitation is revoked** , the logs capture _who revoked it_ but not _which invitation (or invitee)_ was affected. These details are critical for auditability, as they tell us not just _who did something_, but also _what (or who) was impacted_. Is there a recommended approach (or planned feature) to achieve **comprehensive tenant-wide audit logging** that includes API operations, dashboard changes, and organization-level configuration updates? ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [September 30, 2025, 8:45pm UTC](https://community.auth0.com/t/how-to-achieve-tenant-wide-audit-logging-beyond-delegated-admin-extension/192395/3 "2025-09-30T20:45:04Z")
Hi @vitor.fernandes I am sorry about the delayed response to your inquiry! Regarding the situation at hand, are you not able to determine both _ **who performed the action** _ and the _ **affected user** _ by following [this knowledge article](https://support.auth0.com/center/s/article/How-to-Determine-the-User-that-Performed-Change-via-Delegated-Admin-Portal)? Regarding logging any user roles changes using the extension, as our [documentation](https://auth0.com/docs/customize/extensions/delegated-administration-extension) states regarding the user roles: > When logging in as a user using Organizations with Delegated Administration Extension (DAE), your user roles will not be available. Only your Organization member roles will be available within `event.authorization.roles.` If you are talking about logging organization roles, you should be able to do that just fine, you can also try adding their normal roles as app metadata and access it that way. Otherwise, the extension itself it designed to log events in the scope of an organization, so naturally it would not have access to any other tenant wide changes performed. In order to have a more comprehensive audit logging, I would recommend setting up [log streaming](https://auth0.com/docs/customize/log-streams) to capture all the necessary information. Please let me know if the information above is helpful regarding the matter and if you have any other questions! Kind Regards, Nik ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [October 14, 2025, 8:45pm UTC](https://community.auth0.com/t/how-to-achieve-tenant-wide-audit-logging-beyond-delegated-admin-extension/192395/4 "2025-10-14T20:45:35Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.