View the activity log

Last updated May 6th, 2026

This section describes how to view or download a list of activities that were performed in the admin portal.

An activity in the activity log is defined as an action performed in the admin portal that affected the status of the service or a device.

To view the activity log, sign in to the Knox Admin Portal, and click Activity Log in the left navigation.

The list shows information about both service-specific and common activity logs, including:

  • DATE — The date and time the event occurred.
  • INITIATOR — The admin who initiated the event. If using Samsung account for Business, the admin’s account ID and email address are shown. If Knox MSP initiated it, the MSP admin’s email or MSP company name is shown.
  • SERVICE — The service that generated the log for the event.
  • CATEGORY — The category the event belongs to. The common categories are Admin, Device, License, and Reseller, but you may see others depending on your services.
  • EVENT — A brief summary of the event that occurred.
  • DESCRIPTION — If necessary, a description that adds more context to the category and event.
  • DETAILS — Additional information, such as links to license or device details.

By default, the list of events is sorted from newest to oldest.

Filter or search for events

You can narrow the list as needed by doing any of the following:

  • Click the Show all drop down and select Last 7 days or Last 30 days.

  • Set the time filter dropdown to the last 7, 30, or 365 days. If you want to narrow down your search further, click to filter the activity log by a combination of columns.

  • Enter a keyword in the search bar. You can search by exact name. Search supports plus (+), hyphen (-), and underscore (_) characters.

Export activity log information

To download the log to your computer, click Download Activity Log as CSV.

Only the entries that are currently visible are included in the CSV.

Additionally, when any admin generates a report with the following items, the console records that action in the activity log:

  • Devices
  • Device logs
  • Device deletion logs
  • Activity logs

An admin with activity log permissions can then review this event on the Activity log page, and download a copy of the report linked in the Details column.

Is this page helpful?