Audit of who is removing access from workspaces

Dave H

Is there any way to get an audit report of who is removing access from a workspace? We've had this happen several times in our company where someone (probably NOT the same person) has removed a number of people from accessing an entire workspace.

When I try to ask SmartSheets for help all they can do is point me to the access report capabilities in the Admin area. This only tells me what all workspaces and sheets have been access by logged in users. I need to know who is changing the access to the workspace by removing users.

Any suggestions?

-Dave

Paul Newcome

I would suggest reaching back out to support. Let them know the details, explain that you have checked the places they have suggested you check, send them screenshots of the activity logs, etc.. If they try to tell you to check something you already have, insist on an escalation. There should be additional steps that can be done and other places THEY can check.

Paul Newcome

Have you checked the Activity Log for any of the items in the workspace?

Dave H

Thanks @Paul Newcome , but the Activity log on a worksheet won't show me who is editing the workspace shared access.

Paul Newcome

It should.

Dave H

Thanks @Paul Newcome , but it doesn't. I went to the activity log of several of the sheets that was in the workspace and looked for all activity for the last 2 years.....all it shows is when one person was able to grant me access back to it and the actions I took to grant others access to it.

Is this a defect that the logs arent there?

Screen Shot 2023-02-09 at 10.24.45 AM.png

Uploaded Feb 9, 2023283.04 KB

Paul Newcome

Have you had one of the Removed Users check every item in the workspace to see if it is definitely at the workspace level, or are you seeing that their name is no longer included in the workspace level Share window?

Dave H

I checked with everyone who SHOULD have remained on the workspace because it was a frantic rush to grant an entire region access back to their working folders.....almost everyone was removed. The few who remained on the workspace swear that they didn't do anything to remove anyone.

This has happened several times now with SmartSheets. I'm certain that there is a bug in the system, but I can't get to any logs on the workspace share / permissions functions to determine if it is or if it is user error.

Paul Newcome

I haven't run into a bug like this before, but that doesn't mean it isn't one. I would suggest reaching back out to support and get some escalation if they come back with the same answer.

As shown in my screenshot, people being "unshared" SHOULD show up on any of the item's activity logs.

What happens if you check an activity log, "Clear Filters", select "Sharing" from the Action dropdown and then Apply essentially pulling all sharing activity without any regard to date?

Dave H

Ironically, the SAME even happened last night for our workspace N.America Implementation Projects workspace. EVERYONE but 2 people were removed from access.

I did what you suggested - I went to a sheet and opened the Activity log. I cleared the filters and just searched for 'sharing' for the last 4 year date range and NOTHING! No history except for the one record where it was re-shared with me last night.

This has to be a defect.

Screen Shot 2023-02-10 at 10.39.57 AM.png

Uploaded Feb 10, 2023685.26 KB

Paul Newcome

I would suggest reaching back out to support. Let them know the details, explain that you have checked the places they have suggested you check, send them screenshots of the activity logs, etc.. If they try to tell you to check something you already have, insist on an escalation. There should be additional steps that can be done and other places THEY can check.

Dave H

Thank you Paul - I'll let you know how my escalation goes.

-Dave