The Xero user activity log is a built-in audit trail that records who did what in your Xero organisation, and you can view it under Settings → General → User activity. It shows the date, user, and action taken, but it does not capture every keystroke or every single data change, so it is a monitoring tool, not a full forensic audit system.
What the User Activity Log Actually Shows
The log records a broad set of events, including when a user logs in, logs out, creates or edits an invoice, changes a bank transaction, exports reports, or adjusts settings. Each entry includes a timestamp (in your organisation’s time zone), the user’s name and email, and a short description of the action. For example, you might see “Invoice INV-0042 created” or “Bank statement line updated.”
However, the log does not show the before-and-after values of a changed field. If someone edits the amount on an invoice from $100 to $150, the log says “Invoice edited” but not the old and new amounts. For that level of detail, you would need to check the individual record’s history (available on some pages like invoices and bills) or use a third-party add-on that captures field-level changes.
How to Access the User Activity Log
To open the log, go to your Xero dashboard, click on the gear icon (Settings) in the top right, then choose “General settings” and then “User activity.” You will see a list of events, with filters for date range, user, and action type. The log typically goes back a limited period—commonly 90 days for most organisations, though this can vary by plan. You can export the log to a CSV file for offline review or for sharing with your accountant or auditor.
If you are an adviser (accountant or bookkeeper) with client access, you can view the user activity log for each client organisation you have access to, provided your role permissions allow it. The standard adviser role can usually view the log, but some restricted roles may not.
Why You Might Need the User Activity Log
There are several common reasons to check the log:
- Security monitoring: See if any unexpected users have accessed your organisation, or if a user has been active at odd hours.
- Error investigation: Find out who last touched a transaction that now looks wrong, so you can ask the right person.
- Compliance and audits: Provide evidence of who did what for your accountant or external auditor.
- Internal control: Confirm that staff are following procedures, for example, that only authorised people are approving invoices.
- Troubleshooting: If a report or setting changed unexpectedly, the log can show when and by whom.
Limitations and What the Log Does Not Show
A common misconception is that the user activity log records every change to every field. It does not. For example, changing a contact’s phone number or editing a line item on a bill may only appear as a generic “updated” event. Also, the log does not capture actions taken by Xero itself (like automatic bank feeds) or by API integrations unless they are tied to a specific user. If you need a complete audit trail, you may need to combine the user activity log with the individual record history and possibly a third-party app.
Another limitation: the log is not real-time. There can be a short delay before an action appears. If you need immediate alerts, you would need to set up separate notification rules or use a monitoring add-on.
How to Use the Log for Better Security and Accountability
You can use the log proactively. For instance, you might review it weekly to spot any unusual activity, such as a user logging in from a new location or a bulk export of data. If you have employees, you can use the log to verify that they are only performing tasks within their role. For example, if a staff member with only “Sales” access somehow edits a bank reconciliation, the log will show their username, and you can then adjust their permissions.
To keep the log useful, make sure your user list is up to date. When someone leaves, remove their access immediately. If you share login credentials, the log becomes unreliable because you cannot tell which person actually performed the action. Use individual logins for every user, even if they are temporary.
Comparing the User Activity Log with Other Xero Audit Features
Xero has several related features that are often confused with the user activity log:
- Record history: Available on invoices, bills, and some other documents, this shows the changes to a specific record, including who changed it and when, but only for that one record.
- Bank feed activity: Shows when bank feeds were imported and by whom, but not the individual transactions.
- Login history: In some plans, you can see a list of login attempts, including failed ones, under the same user activity area. This can help detect unauthorised access attempts.
- Third-party audit apps: Apps like AuditLog or SafeSend offer more granular tracking, but they cost extra and require integration.
For most small businesses, the built-in user activity log is sufficient. If you are in a regulated industry or have complex multi-user needs, consider a third-party solution.
Common Problems and How to Solve Them
Users often report that the user activity log is empty or missing entries. This can happen if you have just signed up and have not performed any actions yet, or if the log has been filtered incorrectly. Check the date range filter—the default might be set to a short period. Another issue is that the log only goes back a certain number of days; if you need older data, you should export the log regularly to a CSV file and store it securely.
Another common problem is that you cannot see the log because your role does not have permission. Only users with the “Standard” role or higher (like “Adviser” or “Manager”) can access the user activity log. If you are a “Cashbook” or “Invoicing” user, you will not see this option. If you are the organisation owner, you can change roles in Settings → Users.
User Activity Log Template
Below is a simple template you can use to record user activity manually if you need to keep a separate log (for example, for a paper trail or to supplement Xero’s data). Fill in the blanks with the relevant details.
| Date & Time | User Name | Action | Record/Reference | Details |
|---|---|---|---|---|
Sample (fictional): 2025-04-01 10:32 | Jane Smith | Invoice created | INV-1001 | Amount $250.00
Frequently Asked Questions
Can I see who deleted a transaction in Xero?
Yes, the user activity log will show a “deleted” event for the transaction, including the user and timestamp. However, it will not show the original transaction details, so you may need to check your backups or a third-party audit app to recover the data.
How far back does the user activity log go?
Xero does not publicly state a fixed retention period, but in practice, most organisations see about 90 days of history. To keep a permanent record, export the log to CSV on a regular basis and store it in a safe place.
Can I export the user activity log?
Yes, on the User activity page, there is an “Export” button that downloads the current filtered view as a CSV file. You can then open it in Excel or Google Sheets for analysis or archiving.
Does the user activity log show failed login attempts?
Not in the standard user activity log. Failed login attempts are shown in a separate “Login history” section, which you can access from the same menu in some Xero plans. If you do not see it, contact Xero support to check if your plan includes it.
Can I get alerted when a user does something in Xero?
Xero does not have built-in alerts for user activity. You can set up some notifications for specific events (like when a bill is approved), but not for general user actions. Third-party apps can provide real-time alerts.
Is the user activity log a full audit trail?
No, it is a summary of actions, not a field-level audit trail. For a complete audit, you would need to combine it with record history and possibly an external audit tool. If you need this for legal or compliance purposes, consult a qualified professional.