> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://help.sigmacomputing.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://help.sigmacomputing.com/_mcp/server.

# Configure audit logging for Sigma tables (Beta)

> Configure Sigma table audit logging on a connection to keep a history of Sigma table edits in your data platform.

> **Note**
>
> This documentation describes one or more public beta features that are in development. Beta features are subject to quick, iterative changes; therefore the current user experience in the Sigma service can differ from the information provided in this page.
>
> This page should not be considered official published documentation until Sigma removes this notice and the beta flag on the corresponding feature(s) in the Sigma service. For the full beta feature disclaimer, see [Beta features](/docs/sigma-product-releases#beta-features).

Configure Sigma table audit logging on a connection to keep a history of Sigma table edits in your data platform. Each audit log entry records the user who made a specific data or schema edit, when the edit occurred, and what it changed.

To use Sigma table audit logs on a connection, you must complete the following:

* [Configure a shared identity for audit logging](#configure-a-shared-identity-for-audit-logging)
* [Enable audit logging on the connection in Sigma](#enable-audit-logging-on-the-connection-in-sigma)
* [Grant access to the audit log schema](#grant-access-to-the-audit-log-schema)

To manage user access required to view audit logs, see [Configure access for organization-wide Sigma tables](/docs/configure-data-access-for-org-wide-sigma-tables). For information about creating new audit logs and viewing existing ones, see [Audit changes to Sigma tables](/docs/audit-sigma-table-changes).

## Requirements

To configure audit logging for Sigma tables:

* You must be assigned the **Admin** [account type](/docs/account-type-and-license-overview).
* [Write access](/docs/set-up-write-access) must be enabled on the connection.
* You must have permission in your data platform to grant access on the audit log schema.

> **Warning**
>
> By enabling Sigma table audit logs,
>
> Customers
>
> understand and agree that (a) Sigma table audit logs are maintained in the Customer's
>
> Data Warehouse
>
> , and Sigma will access and make entries to these audit logs to reflect the edits made to the corresponding Sigma tables by Customer (or its
>
> User
>
> ); (b) Customers are solely responsible for properly [configuring](/docs/configure-audit-logging-for-sigma-tables) Sigma tables and Sigma table audit logs, including [access](/docs/configure-data-access-for-org-wide-sigma-tables#oauth-connection), [impersonation](/docs/impersonate-users), and [write](/docs/enable-write-access-connection-tables) permissions for Sigma tables and Sigma table audit logs; and (c) Customers should regularly review and audit their Sigma table audit logs to ensure their accuracy and integrity.

## Configure a shared identity for audit logging

To enable Sigma table audit logs, a shared identity (e.g., service account, service principal, or user) must be configured on the connection. Sigma uses the shared identity to create and write to the audit logs, and to delete materialized tables used for bulk edit actions.1

* For a non-OAuth connection, Sigma already authenticates using a shared identity, so no additional configuration is needed.
* For an OAuth connection, Sigma uses each user's own identity to authenticate, so a shared identity might not be configured. To configure a shared identity, see the following guidance based on your connection type:
  * [Connect to Snowflake with OAuth](/docs/connect-to-snowflake-oauth#complete-your-oauth-configuration)
  * [Connect to Databricks with OAuth](/docs/connect-to-databricks-oauth#complete-your-oauth-configuration)

1

Bulk edit actions (single actions that insert, update, or delete multiple rows in a Sigma table) write edits to materialized tables in your data platform before applying them to the Sigma table. For bulk edits, the audit log records the name of the materialized table in the `EDIT` column (see [Audit log entry columns](/docs/audit-sigma-table-changes#audit-log-entry-columns)). For more information about materialized tables for bulk edit actions, see [Create actions that modify Sigma table data](/docs/create-actions-that-modify-sigma-table-data).

## Enable audit logging on the connection in Sigma

Enable audit logging for Sigma tables on the connection, then define the audit log destination schema.

1. In the Sigma header, click your user avatar to open the user menu.

2. Select **Administration** to open the Administration portal.

3. In the side panel, select **Connections** to view a list of available connections, then select the connection you want to configure.

4. In the connection overview, click **Edit**.

5. In the **Write access** section, configure the Sigma table audit log settings as needed:
   1. Turn on the **Enable audit logs** toggle to make audit logs available to all Sigma tables on the connection.
   2. Turn on the **Auto-create audit logs** toggle to automatically create an audit log for every new Sigma table. Keep the toggle off to separately control audit log creation for each Sigma table.

6. Specify the audit log destination schema. Use one other than your connection's configured write schema to ensure you can browse Sigma tables in the data catalog.

   The fields labels depend on your connection type:

   | Connection | Fields                                          |
   | ---------- | ----------------------------------------------- |
   | Snowflake  | **Audit log database** and **Audit log schema** |
   | Databricks | **Audit log catalog** and **Audit log schema**  |
   | PostgreSQL | **Audit log schema** only                       |

7. Click **Save**.

## Grant access to the audit log schema

Grant the shared identity the ability to create and write to audit logs as database tables in the audit log schema.

Select the tab for your connection type to view the relevant data platform guidance. Code comments reference DDL and DML operations; see [Key terms](/docs/configure-data-access-for-org-wide-sigma-tables#key-terms) for definitions.

#### Snowflake

### Grant service account permissions in Snowflake

In Snowflake, grant the connection's service account `USAGE` and `CREATE TABLE` on the audit log schema, and `USAGE` on its parent database. For detailed instructions, see the [GRANT command reference](https://docs.snowflake.com/en/sql-reference/sql/grant-privilege) in the Snowflake documentation.

The following example grants `USAGE` to the `SIGMA_SERVICE` role on the `ANALYTICS_DB` database and `AUDIT_LOGS` schema, then also grants `CREATE TABLE` on the schema.

```sql
-- Allow the service account's role to create and write audit logs in a schema (DDL: CREATE). Creating a table grants ownership, which includes write access.
GRANT USAGE ON DATABASE ANALYTICS_DB TO ROLE SIGMA_SERVICE;
GRANT USAGE ON SCHEMA ANALYTICS_DB.AUDIT_LOGS TO ROLE SIGMA_SERVICE;
GRANT CREATE TABLE ON SCHEMA ANALYTICS_DB.AUDIT_LOGS TO ROLE SIGMA_SERVICE;
```

#### Databricks

### Grant service principal permissions in Databricks

In Databricks (Unity Catalog), grant the connection's service principal `USE CATALOG` and `USE SCHEMA` on the catalog, and `CREATE TABLE` and `MODIFY` on the audit log schema. For detailed instructions, see [Unity Catalog privileges and securable objects](https://docs.databricks.com/en/data-governance/unity-catalog/manage-privileges/privileges.html) in the Databricks documentation.

The following example grants the required privileges on the `analytics_catalog` catalog and `audit_logs` schema to a service principal.

```sql
-- Allow the service principal to create and write audit logs in a schema (DDL: CREATE, DML: MODIFY)
-- Replace <service_principal> with the principal's application ID.
GRANT USE CATALOG, USE SCHEMA
  ON CATALOG analytics_catalog
  TO `<service_principal>`;
GRANT CREATE TABLE, MODIFY
  ON SCHEMA analytics_catalog.audit_logs
  TO `<service_principal>`;
```

> **Info**
>
> Unity Catalog has no insert-only privilege, so `MODIFY` is required for Sigma to write entries to an audit log.

#### PostgreSQL

### Grant connection user permissions in PostgreSQL

In PostgreSQL, grant the connection's user `USAGE` and `CREATE` on the audit log schema. For detailed instructions, see the [GRANT command reference](https://www.postgresql.org/docs/current/sql-grant.html) in the PostgreSQL documentation.

The following example grants `USAGE` and `CREATE` to the `sigma_user` role on the `audit_logs` schema.

```sql
-- Allow the connection's user to create and write audit logs in a schema (DDL: CREATE). Creating a table grants ownership, which includes write access.
GRANT USAGE, CREATE ON SCHEMA audit_logs TO sigma_user;
```

## Related resources

* [Sigma tables overview](/docs/sigma-tables-overview)
* [Configure access for organization-wide Sigma tables](/docs/configure-data-access-for-org-wide-sigma-tables)
* [Audit changes to Sigma tables](/docs/audit-sigma-table-changes)