Shopify records actions related to user management in a specific log. This includes the creation, editing, and deletion of staff accounts, providing a history of these changes. You can find this information in the User management activity log within your Shopify admin settings. (Shopify Help Center)
Key takeaways
- Shopify has a dedicated User management activity log that is separate from the log that tracks general admin actions. (Shopify Help Center)
- This log shows which user took an action, what the action was, and when it happened.
- When a staff member is removed, the log may show "Shopify" as the actor instead of a specific user.
- You can export the user management activity log as a CSV file for security audits or compliance reporting.
- Removing a staff member is a permanent action that cannot be undone.
What is the User Management Activity Log?
The User Management Activity Log is a record of events specifically related to user accounts and roles in your Shopify store. Unlike the activity log that tracks changes to products or settings, this log focuses only on user administration. For example, it records when a user role is created, a staff member's permissions are edited, or an account is deleted.
Each event in the log includes a description of the action, the area affected, a timestamp, and the name of the user who performed the action. (Shopify Help Center) This makes it the primary place to investigate any changes to your team's access.
How to find who removed a staff member
When a staff account is removed, you can use the User Management Activity Log to find out when it happened and who was responsible. The log is located in the security section of your user settings.
- From your Shopify admin, go to
Settings, thenUsers, and selectSecurity. (Shopify Help Center) - In the User management activity log section, click
View. - Look for an event describing the user's deletion. The Event column will describe the action, and the User column will show the name of the person who took that action.
- You can click on an event to see more details about it.
Why does the log sometimes say "Shopify" deleted a user?
You might find an entry in the activity log that says "Shopify deleted" followed by the staff member's name, instead of showing a specific person's name. According to Shopify's documentation, this can happen when a staff member is deleted through the Shopify admin or the Shopify POS app.
While the action was initiated by a person, the log records the system (Shopify) as the actor. This is considered normal behavior in certain scenarios and does not on its own indicate unauthorized access. (Shopify Help Center) If you see this and are concerned, the next step is to check for other related activity or contact Shopify Support for more information.
How to check a user's login history
If you are concerned about a staff account's security, you can also review its recent login history. This can help you spot access from unfamiliar locations, IP addresses, or Internet Service Providers (ISPs), which could indicate a compromised account. (Shopify Help Center)
To review a user's login history:
- From your Shopify admin, go to
Settingsand thenUsers. (Shopify Help Center) - Click the name of the user whose history you want to review.
- Find the Recent access to store section. Here you will see the five most recent login sessions.
- Each session entry shows the date, IP address, ISP, location, and the browser and operating system used for the login.
How to export user activity for audits
For more detailed analysis or for compliance purposes, you can export your user data. Shopify allows you to export users, roles, groups, and the user activity log in bulk as CSV files. (Export user data in bulk for audits and compliance - Shopify Changelog)
The Export button appears on the User activity logs page, which is under Settings > Users > Security in your Shopify Admin. This feature is available to store owners and administrators on all Shopify plans. (Export user data in bulk for audits and compliance - Shopify Changelog)
Common mistakes when investigating staff changes
When looking into user account changes, merchants sometimes make a few common mistakes that can lead to confusion.
| Mistake | Why it happens | How to avoid it |
|---|---|---|
| Checking the wrong log | The log for general store changes is more prominent, but it doesn't track user deletions. (Shopify Help Center) | Always use the User management activity log for staff changes. It's located under Settings > Users > Security. |
| Misinterpreting the "Shopify" actor | Seeing "Shopify" as the actor for a deletion can be alarming, but it's often standard behavior for staff removals. (Shopify Help Center) | Understand that this is a known logging behavior. Correlate the timestamp with other events or team actions before assuming a security breach. |
| Forgetting to check login history | Focusing only on the deletion event misses the context of how the account was being used beforehand. | Periodically review the login history for all staff, especially if you suspect an account was compromised before its removal. (Shopify Help Center) |
A worked example
Imagine you run a store and notice that a staff member named Alex, who handles merchandising, can no longer log in. You suspect their account may have been removed, but you don't remember doing it.
First, you navigate to Settings > Users > Security in your Shopify admin. (Shopify Help Center) You find the User management activity log and click View.
As you scan the log, you find an entry from the previous day. The Event column reads, "The user was deleted," and the Resource column lists Alex's name. You look at the User column to see who performed the action. It lists "Bob," your other store administrator. You now know who removed the staff member and when it happened.
Alternatively, the User column might say "Shopify." In this case, you know the deletion was processed in a way that the log attributes to the system itself. (Shopify Help Center) You could then speak with Bob to see if he removed Alex using the Shopify POS app, which might explain the entry.
Frequently asked questions
Can I find out who deleted a staff member?
Yes, the User management activity log is designed to track this. (Shopify Help Center) However, in some cases, the log will attribute the action to "Shopify" instead of a specific user, especially if the deletion was done via the Shopify POS app.
What is the difference between the user log and the one for general store activity?
The User management activity log specifically tracks events related to user accounts and permissions, such as adding, editing, or deleting staff. (Shopify Help Center) The log for general store activity tracks other admin actions, like product changes, theme edits, or settings updates.
Can I export the user activity log?
Yes, you can export the user activity log, along with lists of users and roles, as a CSV file. (Export user data in bulk for audits and compliance - Shopify Changelog) You can find the export button on the Users > Security page in your admin settings.
How far back does the activity log go?
The log for general store activity displays a maximum of 250 results, so the time period it covers depends on how active your store is. (Shopify Help Center) The documentation does not state a similar limit for the User management activity log, but you can export it to ensure you have a permanent record.
Is removing a staff member reversible?
No, removing a staff member from your Shopify store is a permanent action. According to Easyteam, once an account is removed, it cannot be recovered. You would need to create a new staff account and set up its permissions again.
What should I do if I see suspicious login activity?
If you review a user's login history and see access from an unknown IP address, location, or ISP, it could be a sign that the account is compromised. (Shopify Help Center) You should review your store's security settings and user permissions. If you have ongoing concerns, you can contact Shopify Support for further investigation.
Read next
