Zscaler records the login name and IP address of every admin who logs in to the admin portal and changes policies or configuration settings. To view these records, go to Administration > Authentication > Audit Logs.

The Admin Logins tab displays the login and logout times, source IP addresses, and login names of all admins who logged into the admin portal, as shown below.

Go to the Change Logs tab to download an audit report that includes all policy changes over a period of time. You can download logs for up to 31 days at a time. The service stores audit logs for the last six months.

NOTE: The login and logout times are in UTC. Calculate your local time by adding or subtracting the appropriate hour-offset.