Somebody at a client says Avvi did the wrong thing, and the report arrives without the detail you need.

The record answers most of these without going back to them. It shows what ran, who asked for it, what was targeted, and whether it succeeded.

Start there. A report describes what somebody noticed, and the record describes what happened, and the two differ more often than not.

Before you begin

Get the client, roughly when, and the person’s email address. Those three narrow the record enough to read.

Do not ask for a screenshot first. What they saw is the least reliable part of the account and the record does not need it.

Work the record

1. Open the audit record and filter to that client.
2. Set the date range around when they said it happened, allowing an hour either side.
3. Filter by their email address in the user field.
4. Read what ran, what it targeted, and whether it succeeded.
5. Compare that against what they described.

Refusals are recorded as carefully as successes. A user saying Avvi did something that never ran will show as either nothing at all or as a blocked action.

Good to know

Three outcomes look similar in a report and are distinct in the record: it ran and worked, it ran and failed, or a permission blocked it before anything started.

A change with no confirmation before it did not happen. Nothing that alters a person or their account runs without one.

If the record shows the action ran against a different person than the user expected, the confirmation is where that diverged, and it names the person it was about to act on.

Verify it worked

Whatever you conclude, check the thing itself before replying. If a mailbox permission was supposedly removed, look at the mailbox.

Tell the user what actually happened, including when the answer is that the action was refused rather than performed. Being told the real reason stops the second ticket.

If something doesn’t look right

If nothing appears in the record at all, widen the date range before concluding. People report times loosely.

If the record and the user’s account genuinely cannot be reconciled, open a support conversation from the Help drawer. Include the client, the user’s email address, the time, and what the record shows.

If the user is describing an answer rather than an action, there may be nothing to find. An unhelpful reply is not a recorded event.

FAQ

Q: The user cannot remember when it happened.

A: Filter by their email address and the client, and widen the date range. The list is usually short enough to read.

Q: The record shows nothing. Did they imagine it?

A: More often they are describing a reply rather than an action, or the wrong client. Check both before doubting them.

Q: Can I see what they typed?

A: The record covers what ran, not the conversation around it. Ask them to quote the reply if the wording matters.