Closing The Gap: SAP Signavio Standardizes Audit Events

Intro

SAP Signavio audit logs are being updated to align with SAP's evolving standards. If you use multiple SAP products and access audit logs through the ALS Viewer or Search API, this change directly affects you. Here you'll find everything you need to know about what's changing and when, so you can plan ahead and stay ahead.

Who Is Affected?

This change is primarily relevant for customers who:

Use the Audit Log Search API or Audit Log Viewer, AND
Have automation, dashboards, alerts, or reports that depend on specific audit event types or event fields that are expected to change

What Is Changing?

Historically, some SAP Signavio audit information was provided through the zzzCustomEvent event type. To streamline security logs for SAP customers, SAP regularly evaluates the content within custom events and standardizes content across SAP products. To align with these SAP-wide audit logging standards, Signavio is moving information from the zzzCustomEvent to dedicated standardized event types based on the SAP standard audit logging template. The end goal is that the underlying information remains available, but it will no longer be delivered exclusively through zzzCustomEvent.

To make the transition easier, SAP has devised a phased approach which will allow customers to adapt to any processes and integrations that may be affected by this change.

Transition Timeline

To help you update integrations without disruption, SAP introduced a phased transition period.

Period	Availability
From now until December 1, 2026	Information is available in both zzzCustomEvent and the new standardized event names
After December 1, 2026	Information is available only in the new standardized event names

This approach is expected to provide you with time to review and update any configurations that rely on the existing event structure.

Here is a list of all changes expected in this wave.

Event Logged

Before 1 Dec

After 1 Dec

· Process documentation template created

· Simulation scenario created

· File imported

zzzCustomEvent

dataCreate

· Report exported

· File exported

zzzCustomEvent

dataExport

· Usage of workflow permissions changed

· Approval state changed

· Approval expiration changed

zzzCustomEvent

configurationChange

· User synchronization started

· Configuration synchronization started

zzzCustomEvent

jobStatusChange

· Approval state created

· Approval expiration created

zzzCustomEvent

configurationAdd

· Approval expiration deleted

zzzCustomEvent

configurationDelete

· Permission assignment created for user

zzzCustomEvent

authnPrivilegeToUserAdd

· Permission assignment created from group

zzzCustomEvent

authnPrivilegeToGroupAdd

· Permission assignment deleted for user

zzzCustomEvent

authnPrivilegeToUserDelete

· Permission assignment deleted from group

zzzCustomEvent

authnPrivilegeToGroupDelete

· User marked for deletion

· User license revoked

zzzCustomEvent

dppDataModification

· User authentication succeeded

zzzCustomEvent

userLoginSuccess

What Should I Do?

If you use the Audit Log Viewer or Search API as part of a process, we recommend that you:

Review existing integrations, dashboards, alerts, and monitoring configurations.
Identify any dependencies on zzzCustomEvent.
Update searches, parsing rules, and downstream systems to use the new standardized event types for data after December 1, 2026.
Validate your configuration during the transition period while both event formats are available.

Conclusion

This change is part of SAP's broader commitment to consistent, unified security logging across its product portfolio. The transition period running until December 1, 2026 gives you a practical window to review, test, and update any configurations at your own pace but acting early means more time to validate while both event formats are still available. If you have questions beyond what's covered below, reach out to SAP Support or consult the related documentation linked at the end of this post.

Frequently Asked Questions

What happens if I don't update my configuration in time?

Any automation that relies exclusively on zzzCustomEvent may stop receiving the expected audit information after December 1, 2026. To avoid interruptions, SAP strongly recommends updating configurations during the transition period when data is available in both formats.

Will audit information be lost?

No. The information currently available through zzzCustomEvent is being moved to standardized audit event types. The goal is to improve consistency across SAP products while maintaining access to relevant audit information. The information is still available within the retention period of 90 days.

Do I need to change anything if I only use the ALS Viewer?

In most cases, no action is required. The primary impact is on customers who consume audit logs programmatically through the Search API or external monitoring solutions. You should only be aware of these changes for any post processing done on your security logs.

How long are audit logs retained?

Audit logs are retained for up to 90 days (three months) from the time they are generated. Customers should refer to the latest SAP Help documentation for current retention information.

Where can I learn more?

Additional information about SAP Audit Log Service, the ALS Viewer, and the Audit Log Search API is available in SAP Help.