Change history
See every change in your tenant, who made it and what the settings were before, and jump to the object in the admin center.
The change history lists every change Kairavo observes in your tenant, newest first and grouped by day. For each change it shows what changed, who made it and what the values were before. Open Changes in the sidebar.
What is collected
Kairavo builds the history from two sources:
- Hourly snapshots of your configuration. Kairavo compares each snapshot with the previous one and records what was created, modified or deleted, down to the setting.
- Audit events every 5 minutes from the Intune and Microsoft Entra audit logs. Kairavo uses them to find out who made a change.
The history covers policies, apps, assignments, assignment filters, scripts and other collected objects. The Family filter lists every area, from Settings catalog and Compliance to Conditional Access and Windows 365.
Kairavo collects while it is running. Periods when it was closed are shown as gaps, and a change that falls into such a gap is labelled Spans an unobserved period.
Each change has one of four types: Created, Modified, Deleted or Assignment.
Filter the list
Pick a Time range: Last 24 hours, Last 7 days, Last 30 days or Last 90 days. The list starts with the last 7 days.
Pick a Type to show only created, modified, deleted or assignment changes.
Type part of a name in Object name to find changes to a specific policy, app or other object.
Select More filters to filter by Family, or by Actor with a name or account.
Select Apply filters.
Time range, Type and Family apply as soon as you pick them. Object name and Actor apply when you select Apply filters or press Enter.
The footer shows how many changes are listed. Select Load older changes to read further back in the chosen time range. If nothing matches, select Clear filters.
Before and after values
Click a change to open its details.
- Settings lists every changed setting with its Before and After value.
- Assignments lists assignment changes as Added, Removed or Changed, with the group, whether it is Included or Excluded, the app intent and any assignment filter.
- Version history shows the captured versions of the object over time.
Select Copy previous values to copy the old values to the clipboard. Use them to change the object back in the admin center. Kairavo does not write to your tenant, so reverting is always a manual step.
Entra audit events name the changed properties without their values. For those changes, Before and After show Not recorded. For a deleted object, the last captured values stay in the version history.
Who made the change
Kairavo matches each change in a snapshot with the audit events around it. The details show the result under Attribution:
| Attribution | Meaning |
|---|---|
| Matched to an Intune audit event | One Intune audit event explains the change. Its actor is shown. |
| Matched to an Entra audit event | One Entra audit event explains the change. Its actor is shown. |
| Ambiguous: several audit events could explain it | More than one audit event fits. The list shows Several possible actors. |
| Unknown: no audit event explains it | No audit event fits. The list shows Actor unknown. |
Kairavo does not guess an actor. When the audit events cannot decide, the change keeps an unknown or ambiguous actor.
A change that was seen only in an audit event, and not yet in a snapshot, carries the Audit event only badge. Its details show Not yet in a snapshot under Observed in snapshot.
Open the object in the Intune portal
The details of a change have a button that opens the object in Microsoft's admin center: Open in Intune admin center, or Open in Entra admin center for Entra objects such as Conditional Access policies.
The link opens the matching page in the admin center. For most object types that is the list page of the policy type, not the object itself. In that case the details say "Opens the list page." and name the object to search for.
Deleted objects have no link, because there is nothing to open.