How to Pull Usage Logs for a Specific User Role (Microsoft 365, Salesforce, AWS)
When the auditors ask: how to pull usage logs for a specific role
Short answer: most audit log tools don’t let you filter directly by role. The logs record activity by individual user account, not by the role those users held at the time. The practical path is always the same — find the accounts assigned to the role, then query the logs for those specific users.
Step one: find who holds the role
Before pulling logs, you need the full list of accounts assigned to the role in question. How you do this depends on your platform.
- Microsoft 365 / Entra ID: In the Microsoft 365 admin center, go to Roles → Role assignments, pick your role, and you’ll see every user assigned to it. PowerShell works too:
Get-MgDirectoryRoleMemberwill return the same list. - Salesforce: In Setup, go to Users → Roles (or Profiles if that’s how your org manages permissions). The role detail page shows which users are assigned.
- AWS IAM: Roles in AWS work differently — users assume roles temporarily rather than holding them permanently. You query CloudTrail using the role ARN rather than individual usernames.
Microsoft 365: the audit log in Microsoft Purview
Microsoft 365 audit logs live in Microsoft Purview (formerly the Compliance center). Your account needs the Audit Logs or View-Only Audit Logs role in Purview to access them — not just any admin role in the tenant.
Once you’re in, go to Audit → Search. Set your date range, then paste the usernames from step one into the Users field. Multiple users can go into a single query. Export the results to CSV when you’re done.
Default retention is 180 days for most Microsoft 365 plans. If the auditors need data older than that, check whether your org has a custom audit retention policy configured in Purview. If not, that data is gone.
Salesforce: Setup Audit Trail
Go to Setup → Quick Find → View Setup Audit Trail. Salesforce shows the last 180 days of administrative changes and lets you download the full history as a CSV.
There’s no role filter in the UI itself. Download the full export, then filter by username in Excel or another tool using the list from step one.
One thing to flag for auditors: Setup Audit Trail covers admin configuration changes, not day-to-day record access or report downloads. For that level of detail you need Salesforce Event Monitoring, which is a paid add-on.
AWS: querying CloudTrail by IAM role
Because IAM roles are assumed temporarily, CloudTrail captures sessions rather than permanent role membership. To find all activity from a specific role, filter on the role ARN. Using Athena:
SELECT *
FROM cloudtrail_logs
WHERE useridentity.sessionContext.sessionissuer.arn LIKE '%your-role-name%'
AND useridentity.sessionContext.sessionissuer.type = 'Role'The CloudTrail console event history covers 90 days. Anything beyond that requires an active trail that was already logging to an S3 bucket.
Before you hand anything to auditors
Confirm audit logging was actually enabled for the period in question. Microsoft 365 has auditing on by default; AWS CloudTrail has to be configured deliberately. If it wasn’t running, you cannot recover the data retroactively.
Watch the retention window. Export early, keep the raw file alongside any filtered version, and document your exact query parameters. Auditors often want the unfiltered export to confirm nothing was selectively excluded.
If your main admin is unavailable and you don’t yet have the right permissions, a Global Admin can grant temporary read-only access without handing over full admin rights. In Microsoft Purview, the View-Only Audit Logs role is enough to run searches and export results.