Skip to main content
All CollectionsGetting StartedInstalling IntercomSecurity in your workspace
Review actions taken in your workspace with Teammate activity logs
Review actions taken in your workspace with Teammate activity logs

See the actions you and your teammates take in Intercom like setting messages live, logging in and more.

Beth-Ann Sher avatar
Written by Beth-Ann Sher
Updated over a week ago

In many cases it’s useful to be able to identify exactly who made a change in your Intercom workspace. Teammate Activity Logs can help you understand when features or settings are enabled or disabled for your workspace. It can also tell you when important actions are taken. For example:

  • Messenger or workspace settings being changed.

  • Messages or campaigns being set live or paused.

  • People invited to your workspace.

  • Data being exported.

  • And more.

It’s easy to find the person responsible for these changes in Teammate Activity Logs:

Teammate Activity Logs are available on all Intercom plans and are available for one year.

Teammate activity data older than one year can be accessed via our REST API.

How to search logs

You’ll find Teammate Activity Logs under Settings > Workspace > Teammates > Activity logs:

You must have the Can manage general & security settings and Can manage teammates, seats & permissions permission to access the activity logs.

From here you can manually scroll through the most recent activity, or filter for specific actions or teammates:

Pro tip: If you have an idea of when an action happened, you can narrow the results to a certain date range.

You can also download the logs in CSV format:

Each result shows:

  • Activity — Includes the name of the teammate who completed the action.

  • Date and time the action was completed.

  • The IP address the action was completed from.

Which actions are logged?

You can see a historical log of the following teammate actions and changes in your workspace.

Event name

Description

Admin impersonation session end

End of a session where admin impersonation occurred

Admin impersonation session start

Start of a session where admin impersonation begins

App installation

An app was installed in your workspace

App token regeneration

An app token was regenerated

App uninstallation

An app was uninstalled from your workspace

Article content created

Creation of article content

Article content deleted

Deletion of article content

Article content published

Publication of article content

Article content unpublished

Unpublishing of article content

Article content updated

Update of article content

Article created

Creation of an article

Article deleted

Deletion of an article

Billing contact address bounced

Email to billing contact address bounced

Billing contact changes

Changes in billing contact information

Bulk deletion

User or lead data was deleted from your workspace

Bulk export

User or lead data was exported from your workspace

Campaign deletion

Deletion of a campaign

Campaign state change

Change in the state of a campaign

Conversation part deletion

Deletion of a conversation part

Conversation topic change

A teammate changed a conversation topic

Conversation topic creation

A teammate created a conversation topic

Conversation topic deletion

A teammate deleted a conversation topic

Data export created

Creation of a data export

Data export run

Execution of a data export

Email signature change

Change in email signature

Fin AI Agent opt-in

A teammate opted your workspace into Fin AI Agent

Help center settings change

Your Help Center was turned on or off

Identity Verification reminder disabled

Disabling of Identity Verification reminder

Inbound conversations change

Change in inbound conversations

Inbox access change

Change in inbox access

IP allowlist settings change

Change in IP allowlist settings

Message deletion

Deletion of a message

Message state change

A teammate changed the state of a message

Messenger availability changed

Change to Messenger availability

Messenger look and feel change

Change to Messenger look and feel

Messenger spaces change

Change to Messenger spaces

Office hours change

Change in office hours

Recovery code sent

Sending of a recovery code

Require an email for new conversations change

Change in the requirement for email in new conversations

Role creation

A teammate created a role

Role deletion

A teammate deleted a role

Role permission change

A teammate changed the permissions of a role

Ruleset creation

Creation of a ruleset

Ruleset deletion

Deletion of a ruleset

Ruleset live status change

Change in live status of a ruleset

Search for Articles Enabled / Disabled

Enable/Disable search for articles

Search for Articles Required change

Change in requirement for articles in search

Seat change

A teammate changed the seat

Security settings change

A teammate changed security settings

Special notice change

Change in special notices

Teammate assignment limit change

A teammate changed their assignment limit

Teammate away mode change

A teammate changed their away mode

Teammate deletion

A teammate was removed from your workspace

Teammate deprovisioning

A teammate was deprovisioned from your workspace via SCIM

Teammate invite change

The permissions for a teammate invite were changed

Teammate invite creation

A teammate invite was created

Teammate invite deletion

A teammate invite was deleted

Teammate login failure

A teammate tried to login with the wrong credentials

Teammate login success

A teammate logged in successfully

Teammate logout

A teammate logged out

Teammate mobile login failure

Failed mobile login for a teammate

Teammate mobile login success

Successful mobile login for a teammate

Teammate email change

A teammate changed their email

Teammate name change

A teammate changed their name

Teammate password change

A teammate changed their password

Teammate password reset request

A teammate requested a password reset

Teammate password reset success

A teammate's password was successfully reset

Teammate permission change

The permissions for a teammate were changed

Teammate provisioning

A teammate was provisioned on your workspace via SCIM

Teammate two factor authentication change

A teammate changed their two-factor authentication

Teammate unauthorized sign-in method

Unauthorized sign-in method for a teammate

Welcome message change

Change in welcome message

Workspace authentication method change

Your workspace's authentication methods were changed

Workspace data deletion

A user or lead was deleted from your workspace

Workspace data export

Message or conversation data was exported from your workspace

Workspace Google SSO domain change

Your workspace's Google SSO domain was changed

Workspace identity verification change

Your workspace's identity verification setting was changed

Workspace name change

The name of your workspace was changed

Workspace outbound address change

The outbound email address was changed for your workspace

Workspace team creation

A team was created

Workspace team deletion

A team was deleted

Workspace team membership modification

A team's membership was modified

Workspace teammate join

A teammate joined your workspace (i.e. accepted your invite)

Workspace timezone change

Change in timezone for a workspace

Workspace webhook creation

A webhook subscription was created

Workspace webhook deletion

A webhook subscription was deleted

Note: It's currently not possible to see the reason why a teammate was away in the Teammate Activity Logs. This information is only available on the Real Time Dashboard.


💡Tip

Need more help? Get support from our Community Forum
Find answers and get help from Intercom Support and Community Experts


Did this answer your question?