2744431 - How to Create Change Audit Reports and What Reports are Available - SuccessFactors

• How to create a Change Audit Report
• What reports are available?
• What are the modules supported by Change Audit Report
• How can we access SuccessFactors System logs?
• Can we export the logs for tools such as Splunk/SIEM?
• Retention Policy configuration in Change Audit Report
• Audit the changes in Manage language , Manage Email Notification , Manage Support Access

SAP SuccessFactors HXM Suite

Creating Change Audit Reports

• The Change Audit Reports are divided in two types: Personal Data Reports and Configuration Data Reports
• Within in each type there are several options of reports to create
• The following SAP Help Portal Article provides guidance on creating each report, divided by types: Creating A Change Audit Report

What Reports are Available?

• The SAP Help Portal also provides the details regarding all the jobs and what each one covers: Types of Change Audit Reports
• In the section "Related Information" you will find a link for each report showing more specific details

Which Modules are Supported by Change Audit Report?

Please, take time to read what is support in each module: Important Notes about Change Audit for Personal Data

Frequently Asked Questions

• How to get a report on user status change? (active/inactive)
• In order to check when some user status was changed and who did the change, you need to use the User Change Report, inside the Create Business Data Report tab. This report will bring all the changes done in the UDF (User Directory File) fields, including the status. For further information on User Change report please see this link here.

• Is it possible to get report on user account changes? (Login Name, Login Method...)

• You can now run change audit reports to track user account changes, including changes to account status, login name, login method, locale, time zone, account type, global user ID, and person UUID. See details in the Help Guide - Change Audit Reporting for User Account Management

• How to get a report on Provisioning Changes? 
• To generate report on Provisioning Changes run the Feature Settings Audit see details on KB article 2771768 - Feature Settings Audit Report - How to Audit on Provisioning. This Audit report only audits on provisioning enabled /disabled features.
  
  
• Does the "Feature Change Audit Report" include changes on all features in Admin Center?
• The "Feature Audit Report" only captures changes on enable/disable Provisioning features, some of these provisioning features have been moved to Admin Center to enable from there - To confirm even if the feature is enabled or disabled from Admin center or provisioning it will be captured in the report - this report does not include all admin center changes. 
  
  
• How long the system keep the audits reports in the system?
  • Until the moment SuccessFactors does not have a structured policy about the retention of the audit reports in the change audit. So, the system is keeping the reports since the activation of the feature.
    
    
• Is it possible to have audit on proxy?
• It is not possible to have audit on, for example, who did proxy as determined user. Otherwise, it is possible to know when some change was performed by someone who proxied. For example, if some change in the user data was performed by User A, in the report it will be shown if it was performed really by User A or by someone who was proxying as User A. Also, Proxy Assignment Change Report track changes made to proxy assignments, see details in the Help Guide - Proxy Assignment Change Report | SAP Help Portal
  
  
• Is it possible to have audit on people who access determined feature or dashboards?
• The change audit feature is able to perform audit only on changes made in the system, that have generarated a record in the database. When some user simply access some feature, or dashboard, or tile, no record is generated in the database. This way, we don't have audit on this data.
  
  
• Is it possible to have audit on Manage Home Page changes?
• Currently, there is not any option to audit changes made on Manage Home Page feature.
  
  
• Does Change Audit Feature respect the RBP permissions to view certain data when showing the report?
• No. If the users have the necessary permissions to access, view and run change audit reports, they will be able to report on anything user-related on the system, and there will not be any restriction on the data shown in the reports.
  
  
• Is it possible to export the audit logs in .XLS files?
• No. You can only export the logs in .CSV files. 
• Sometimes the results of the changing audit are not shown for complete, due to a certain limit of characters. In this case, at the end of the result of the change, will appears three dots indicating that there's more content but is not shown.
  
  
• Is it possible to export the system logs to access them via external data management tools such as SIEM/Splunk?
• Success Factors' system logs are only accessible via Change Audit Reports. As a Cloud-designed Solution, the logs are generated in a Data Center level, and not for each customer environment. So it's not possible to export the application logs for each customer, neither connect them to external data management tools such as SIEM/Splunk. 

Note:

• Some types of change audit data can take from 8 to 32 hours to be made ready for reporting. Solutions impacted by this delay include: Compensation (except Rewards and Recognition), Performance and Goals (except Continuous Performance Management), Succession and Development (except Mentoring), Employee Profile, User Management, Proxy Management, and Role-Based Permissions. For these solutions, wait for 32 hours after the desired date range before you run the audit report. Otherwise, recent changes may not appear or the report may be blank.

• Please consider date starting always at the time set as 12:00 a.m, once system take the server time zone.

• Change audit data for other solutions are not impacted by this delay.
  
  
• Engineering team sets a maximum number of change records for an instance to accommodate the server workload and performance. If you select a date range that has data exceeding the max number in the system, the audit job will fail. As a workaround, please select a smaller date range.
  
  
• For Proxy Audit Reports, "All modules but no access to "****" (***:specifc module name) is displayed when user has selected all modules. If user has selected two or three modules apart from selecting All modules , the report shows the list of modules the user has proxy permission under Permission column in the proxy audit report.
• With 1H 2024 release, changes made in Manage Languages, Manage Email Notifications, and Manage Support Access are now added in change audit and you can create change audit reports on these changes. You can create change audit reports for the above changes in Admin Center > Change Audit Reports > Create Configuration Data Report >Locales and Customizations, Email Notifications, or Manage Support Access.
• You can configure retention policy for the new change audit data in Admin Center > Manage Audit Configuration > Audit Retention and they will be purged automatically according to the retention policy. See Guide Link

FAQ - Additional Information

Q) Where can I get information on this from the Guide?

A) Guide: Change Audit Admin Guide

Chapter: Feature Settings Audit Report or Creating a Change Audit Report

• 2618848 - Enabling Change Audit Feature
• 2790859 - Change Audit Log Report for Metadata Framework (MDF) Configuration and Data Changes.
• 2789153 - Automatically schedule, view and access reports during the Generation of Change Audit Reports
• 2771768 - Feature Settings Audit Report - How to Audit on Provisioning
• 2491304 - Type of Audit Reports

SF, success factors, RPT, bizx, biz x, PLT, platform, change audit, audit proxy, active, inactive, provisioning changes, access, dashboards, dash boards, tiles, employee, user, status, login name, login method, locale, time zone, account type, global user ID, person UUID, SIEM, Splunk, system, retention policy , changes , Manage Languages, Manage Email Configurations, and Manage Support Access , Audit Retention , https://help.sap.com/docs/SAP_SUCCESSFACTORS_RELEASE_INFORMATION/8e0d540f96474717bbf18df51e54e522/9a19d3d24fc1434aaa402597d7aa1782.html?parentHref=%2Fwhats-new%2F8fcf4960eea24f78b1d7613da406a885%3FArea%3DPlatform%26Version%3D1H%25202023%26q%3Dchange%2520audit%26locale%3Den-US&parentName=SAP%20SuccessFactors%20What%27s%20New , KBA , LOD-SF-PLT-CHA , Change Audit , LOD-SF-EC , Employee Central , LOD-SF-PLT-AUDR , Request Audit Report (Not Change Audit) , How To