Stormwater management needs to inspect which admin recently changed license assignments for seasonal crews. Which review approach fits?

Stormwater management inspecting which admin recently changed license assignments for seasonal crews should review audit logs for administrative activity around those license changes. License assignment and removal are administrative directory operations recorded in the audit trail, enabling accountability for seasonal hiring waves without relying on rumor.

Checking usage reports for administrative activity around license assignment changes shows adoption and activity aggregates, not the audited admin actor and timestamp for a specific license change, so it cannot identify who made the edit. Reviewing billing records for administrative activity around license assignment changes shows charges and license counts, not the historical admin actor and timestamp behind a recent change. Reviewing sign-in logs for administrative activity around license assignment changes shows authentication events, not administrative license operations or which admin performed them.

Exam caveat: Administrative change questions on AB-900 point to audit logs. Usage reports, billing records, and sign-in logs for administrative activity are distractors that confuse other reporting planes with the audit trail and fail the who-changed-it test.

Operational check: Search the audit log for license-related directory operations in the relevant window, filter by stormwater/seasonal crew users, note the admin actor and correlation IDs, confirm the change matched HR authorization, and tighten privileged access (PIM, fewer standing license admins) if unauthorized changes appear.