Monday, 9:10. A team lead writes: "Our contractors can't see the PAY board since Friday." You open the Jira audit log and find one entry from Friday afternoon: Permission scheme updated. Which grant changed? What did it say before? The entry doesn't tell you.
I'm Marcin, founder of Radrly, which builds ConfigRadar, a configuration change history app for Jira Cloud. Most of this article covers what you can do natively today, including two simple habits. The app comes at the end.
Step 1: Get the most out of the native audit log
Go to Settings > System > Audit log (you need the Administer Jira permission). You can search, filter by date, and export the results to CSV. For some changes the entry lists old and new values. For many others it records only that the object was updated, like the entry above.
Check retention while you're there: Actions > Audit Log Settings lets you keep 1, 3 or 6 months. If yours is set lower, raise it to 6 months now. Atlassian documents both settings in Audit activities in Jira applications.
Step 2: Reconstruct the "before" state
When the entry gives no detail, you have three options:
- Compare the scheme with another space that used the same scheme and wasn't changed.
- Ask the person named as the author.
- Compare with a copy you made earlier. This is the habit worth adopting: before you edit a permission scheme or a workflow, copy it from its admin page. The copy is your "before" state, and you can delete it a month later.
Step 3: Keep history longer than six months
Six months is the maximum for the Jira audit log. Many audits cover twelve months. Two native options:
- The organization audit log in Atlassian Administration (Insights > Audit log) covers organization-level activity. Atlassian recommends exporting it regularly. See View audit log activities.
- Pull Jira audit records on a schedule with
GET /rest/api/3/auditing/record and store them yourself. It works, and you now own a script and a storage location.
Where the native path stops
- Many entries say "updated" without the old and new values.
- Retention tops out at six months in the Jira audit log.
- No alert fires when someone changes a scheme you care about.
- There is no guidance for putting the old configuration back.
- An exported CSV can be edited, so it proves little by itself.
Atlassian's public tracker has open requests for longer audit log retention (JRACLOUD-68267) and for logging custom field configuration changes such as contexts, options and default values (JRACLOUD-74945).
The same Monday with ConfigRadar
ConfigRadar imports the Jira audit log on a schedule (hourly on most sites), listens for live events, and takes a daily normalised snapshot of 14 configuration types, including workflows, permission schemes, custom fields and contexts, screens, space role actors and global settings. Normalisation means a simple reordering doesn't show up as a change. At install it backfills 30 days of audit log and takes a first snapshot; history before that can't be recovered.
1. Find it. Open Apps > ConfigRadar and filter the timeline by object type, severity, source or date.
Change timeline with filters for object type, change, severity, source and date.
2. See it. The diff shows the permission scheme before and after, with grants by name: "Browse spaces: Space role Contractors" marked Removed.
3. Judge it. An impact explanation states why the change matters, with a High or Medium rating.
4. Fix it. Revert guidance lists numbered steps with the admin path and a Copy button. ConfigRadar never changes Jira configuration, so you apply the steps yourself.
Before and after for a permission scheme, with revert steps.
5. Prove it. Export the history as CSV. On Advanced, the change ledger is hash-chained so you can verify that nothing was altered, and you can export a PDF auditor pack.
Compliance export: CSV for any period, and the PDF auditor pack (Advanced edition).
ConfigRadar comes in two editions, Standard and Advanced. Standard includes the change timeline, before and after diffs, impact explanations, revert guidance, CSV export, the weekly digest inside the app and a dashboard gadget for configuration risk. It keeps 90 days of history, shorter than the native six months, so keep the native audit log at six months as well. Advanced lets you choose a retention of 30 to 1,095 days.
Advanced also adds:
- Real-time alerts from watchlist rules, shown in the app or created as Jira work items
- Baselines with drift detection
- Periodic summaries as a Jira work item
- A space-admin view
- A read-only ConfigRadar agent in Rovo for Jira admins, with actions to search changes and show an object's history
ConfigRadar runs on Atlassian with zero egress: no email, Slack or webhooks, and IP addresses and emails from the audit log aren't stored. Its only writes to Jira are the optional alert and summary work items on Advanced.
Listing: ConfigRadar on the Atlassian Marketplace.
How do you keep configuration history today? If you have a script against the audit records API, I'd be glad to compare notes in the comments.
