Access History

Could this user access Finance last March?

Pick a person, a site or file, and a date. Access Witness tells you what they could do then, the route that gave it to them, the changes around it, and how sure the answer is.
Request a DemoHow it works
Access History query for John Smith and FY2026 Budget.xlsx as of a moment in the past, and the reconstructed answer: Read, with the path Payroll, Finance Visitors, John Smith.
The Access History page: what could John Smith do to FY2026 Budget.xlsx as of Feb 14, 2026, 09:00 UTC. The answer is Read, through Finance Visitors, with each step of the path and the date it has been in place. Sample Contoso Finance data.

Historical state

One selector, the whole product follows

View state at sets Permission Structure and Access Map to one past instant: the permission structure, group memberships, sharing links and effective access all answer for that moment, and Access History asks for a date of its own. Historical mode is unmistakable: the selected time, the coverage boundary and a way back to today are always visible.

  • Select user, resource and time

    Choose any person, guest, group or sharing link, any site, library, folder or file, and a date and time.

  • Resolve historical effective access

    The permission level they held at that moment, the route it came through, and every change that affected it.

  • Compare a period

    Pick a period and see every change in it (assignments, memberships and links), and whose access was different at its end than at its start.

Confidence and coverage

Every answer says how much to trust it

History starts with the first full scan. Nothing earlier is guessed. Within that history, each answer carries one of four labels.

  • Verified snapshot

    Seen directly in a scan taken at that moment.

  • Reconstructed

    Worked out from the first full scan plus every change recorded since. Each step has evidence.

  • Partial

    Some memberships or assignments could not be confirmed for that moment. Treat it as indicative.

  • Unknown

    It was not recording yet at that moment, so it says so rather than guessing.

Microsoft 365 can take hours to report a change, so the most recent answers can still change as reports arrive. Corrections are kept alongside what they replace; nothing is quietly overwritten.

Who else

Who else gained or lost access over a period

The same period chosen at the top of the page also compares everyone who can reach the object: whose access was different at the end of the period than at its start, and through which groups.

Who else gained or lost access to this: Alex Turner and Elena Vance, both Changed from Read to Edit, through Payroll, Finance Visitors and Finance Contractors (and External Auditors for Elena Vance); 5 others kept the same access throughout.
Who else gained or lost access to FY2026 Budget.xlsx between Jan 15 and Jan 24, 2026, the week Finance Visitors was raised from Read to Edit on Payroll: Alex Turner and Elena Vance went from Read to Edit through groups nested in Finance Visitors, and five others kept the same access. Sample Contoso Finance data.

Related events

The events behind the answer

Each historical answer links to the events that produced it, so a reviewer can walk from the effective role back to the change and its actor.

The What changed list in Access History: Adele Vance removed a sharing link on Feb 16, 2026 and Megan Bowen removed John Smith from Finance Visitors on Feb 15, each From the audit log with a reference number, above the moment picked, Feb 14, 2026, 9:00 AM, when John Smith had Read.
What changed, with the moment you picked placed among the changes: after it, a sharing link removed and a group membership removed; each says who made it, the access before and after, and where it was recorded. Sample Contoso Finance data.

Access History

Answer the auditor's question with evidence, not a guess.

See a historical access query resolved end to end on the Contoso Finance sample scenario, then discuss what coverage would look like for your tenant.

Request a DemoRead the audit guide

Private deployment. Customer-controlled SQL database. Outbound-only connectivity.