> ## Documentation Index
> Fetch the complete documentation index at: https://docs.idemeum.com/llms.txt
> Use this file to discover all available pages before exploring further.

# JIT access auditing

> Every Entra or computer just-in-time access is captured in idemeum audit trail.

## How to access audit trail

* Login to your idemeum admin portal
* Navigate to `Activity` → `Audit trail`

<img src="https://mintcdn.com/idemeum/H3VxQ-RVctp0L3SP/images/CleanShot-2026-05-25-at-16.12.17@2x.png?fit=max&auto=format&n=H3VxQ-RVctp0L3SP&q=85&s=69434d9f2ae5f9bd8ea3e572d024e671" alt="Clean Shot 2026 05 25 At 16 12 17@2x" width="3268" height="2138" data-path="images/CleanShot-2026-05-25-at-16.12.17@2x.png" />

### JIT for computers audit trail

The following events are captured for computer access.

`Computer access` - this event provides technician email address, desktop name, and the account that was used for login.

```text wrap theme={null}
alex@nikpot.com logged into the Desktop W11-L-ELEVATED with account MSP-ALEX.
```

`Log off or lock` - this event provides technician email, desktop name, and account that was used.

```text wrap theme={null}
alex@nikpot.com has logged off the Desktop W11-L-ELEVATED with account MSP-ALEX.
```

`Offline code retrieval` - when a technician accesses offline code on a mobile device for a workstation, mobile application captures the event.

```text wrap theme={null}
alex@nikpot.com accessed offline code for Desktop machine W11-L-ELEVATED.
```

### JIT for Entra audit trail

The following events are captured for Entra ID access.

`Entra account request` - when technician navigates to idemeum portal and requests Entra ID account to be enabled or provisioned, we capture an event along with technician email address and the account name that will be provisioned.

```text wrap theme={null}
alex@nikpot.com requested access to application Entra 365 onmicrosoft. User account msptech6913@NETORGFT11060369.onmicrosoft.com created.
```

`Entra account disabled` - we capture audit events when technician Entra ID accounts are disabled. This happens when configured time for which account needs to stay active passed (default 4 hours).

```text wrap theme={null}
System disabled user account msptech6913@NETORGFT11060369.onmicrosoft.com in application Entra 365 onmicrosoft.
```

`Entra account credentials access` - audit event is captured when technicians view credentials for Entra ID accounts.

```text wrap theme={null}
alex@nikpot.com accessed Entra 365 onmicrosoft credentials.
```
