When changes are made within Google Calendar, it’s important that the available audit logs in the Admin console have the information you need to understand what happened. We have made it easier to do that for changes originating from a third-party system (such as Microsoft Exchange or IBM Notes). In these instances, the third-party system sends the user an email with an attached ICS file.

To help you better investigate situations like these, we’ve added new information to the audit logs, including:

• The address of the email sender
• The ID of the message that you can use in Gmail audit logs for further investigation
• The third-party system that sent the message (for example, "Microsoft Exchange Server 2013"), and
• The email recipient.

To see all third-party-originated changes, filter activities by selecting “Gmail ICS Parser” in the API Kind field.

Below is an example of an audit log for an event invitation from Microsoft Exchange user [email protected] sent to Google Calendar user [email protected]:

• Activity Name: Event created
• Activity Description: [email protected] created a new event Weekly Team Meeting
• User: [email protected]
• Calendar Id: [email protected]
• Event Title: Weekly Team Meeting
• Event Id: _60q30c1g60o30e1i60o4ac1g60rj8gpl88rj2c1h84s34h9...
• API Kind: Gmail ICS Parser
• User Agent: Microsoft Exchange Server 2013
• Recipient Email: [email protected]
• Message Id: < 001a11474d047be4c80553f59b74 altostrat.com="">
• Date: May 22 7:53 AM

With this information, you’ll be able to investigate the change yourself, without having to rely on G Suite Support looking into it for you.

View these reports in the Admin console under Reports > Calendar.

Launch Details
Release track:
Launching to both Rapid Release and Scheduled Release

Editions:
Available to all G Suite editions

Rollout pace:
Full rollout (1–3 days for feature visibility)

Impact:
Admins only

Action:
Admin action suggested/FYI

More Information
Help Center: Calendar audit log

Source: G Suite Updates Blog