Is there a way to see a log of changes to user permission sets?

[jbernal]

Our users suddenly lost the ability to select "All Results" when scheduling/sending/downloading a look in order to get over the 5k row limit. They used to be able to do this and as of last week they can't.

I don't recall anyone having changed the permissions but I do see that the download_without_limit permission has been turned off. 

Is there a way to find a record of permission changes? Like a log of someone having updated the role/permission set on a certain date?

[Sharon_Z · Accepted solution]

Hi @jbernal, you can try to see if this is captured in the System Activity Event explore (explore/system__activity/event). If you filter on event name, there is one called `update_role`. You can also pull in a User ID or Name field to see which user that event was attached to. 

[jbernal]

Thanks Sharon. I was able to find some records of a change to a role but is there a way to find out what role was actually updated? Or to go even further, what change was made? As it stands this would only tell me that a role was updated by a person at a given time but not which role that was and what the changes were.

[Sharon_Z]

It doesn't look like we track historical states of roles within the System Activity data so unfortunately, there isn't a way to grab that information. If you're hosting your own Looker instance, then you could find this in the log files. If we're hosting your Looker instance, try reaching out to Support to see if they can dig into our logs to see if they can find that specific change?

[jbernal]

This page shows update_permission_set as a event that is logged. It has an old and new permission set attribute which seems to imply it has a list of the permission sets before and after the change. Am I reading that right? That seems like what I'm looking for, no?

[Sharon_Z]

Ah good find! Just tested and the Event attribute explore will indeed give that to you that info.