Change History

Cayosoft Guardian collects changes from connected systems and presents these changes in the Change History.

Nested group membership records

If nested group membership collection is enabled, Change History also displays transitive membership records alongside the native member changes that triggered them. These records have:

• Action — Add AD Group nested member(s) or Remove AD Group nested member(s)
• Properties — Nested membership path, Nested members
• The same Correlation ID as the native membership change that caused them

Opening such a record and selecting the Properties tab shows two properties:

• Nested membership path (va_transitiveMembershipPath) — the propagation path, for example Group B < Group A
• Nested members (va_transitiveMembers) — the effective member(s) added or removed

Object names in these values (member names and the group names in propagation paths) are clickable links that open the corresponding object.

The Related history records property on the General tab lists all records that are part of the same transaction (the native change and its resulting transitive records). This differs from the Find related action, which also returns all records for the same target object.

Searching in the Change History

To search for specific changes in Change History:

1. Open the Cayosoft Guardian web portal.

2. Expand the Change Monitoring node.

3. Select Change History.

4. Observe recent change records.

5. Use one of the searching and filtering methods or combine them.

   1. (Optionally) Use the text search box.

   2. (Optionally) Use the quick filter bar to select a saved query, for example, Active Directory users changes.

   3. (Optionally) Use predefined filters such as When, What, Where, and others.

Undeleting an object from Change History

When Cayosoft Guardian has recorded the deletion of a supported object, you can undelete it directly from the deletion record:

1. Open the Cayosoft Guardian web portal.
2. Expand the Change Monitoring node and select Change History.
3. Locate the deletion record for the object (for example, use the What filter to find Delete operations, or search by the object name).
4. Select the record and click Undelete.
5. Confirm the operation.

For Microsoft Entra ID security groups, the group is restored from the Microsoft Entra ID Recycle Bin with its original object ID. You can verify in the Microsoft Entra admin center that the restored group retains the same ID it had before deletion.

Undelete from Change History is available only while the deleted object is still in the Microsoft Entra ID Recycle Bin (within the 30-day soft-delete retention window). Learn more in: Objects supported by Cayosoft Guardian.