Missing Action in the Org Audit Log?

[Hannes]

Hi Community,

yesterday we had login issues into Jira Cloud and later on also we experienced multiple problems in our Jira instance. There was a former user already active (Org admin) and we have the feeling, this user could have manipulate some settings. But the Jira Audit Log and the Org Audit Log do not display anything relevant from this user. Also we checked the Global Automation Log Files with any detection.

The user has been disbled, but what is possible to do for an Org admin without being logged? I tried some actions like IP allowlist or Automation Rules deleting stuff (and than delete the rule), but all actions are logged correctly. We want to know if there are security gaps we have to take care on.

Thanks a lot for your ideas.

[Arkadiusz Wroblewski]

Hello Hannes,

I would be careful relying solely on the audit log, as its depth is limited on the Free plan and it primarily tracks configuration changes.

Ensure the former admin's account is fully suspended, revoke their API tokens, and check for connected third-party apps or automation rules that might still be running.

If you suspect unauthorized activity but find nothing in the logs, please raise a private ticket with Atlassian Support so they can inspect the backend session histories for you.

Best,

Arkadiusz🤠

[Hannes]

Hi!

To clarify: This is a standard edition. I do not have the feeling any action is possible without leaving some steps behind.

[Arkadiusz Wroblewski]

Then i don´t think you have any Security Gaps if User was properly Suspended.

As far as there no Exist any Shadow Admin Accounts you should be fine.