What did the agency actually change? A Shopify audit log check before you revoke access
The moment before you click "remove staff account"
A project wraps up. The agency delivered what you hired them for, the invoice is paid, and it's time to revoke their access to your Shopify admin. Most merchants do this in a few seconds: open Settings → Users, find the agency's account, remove it.
That's the right move eventually. But it skips a question worth answering first: what did they actually change while they had access?
Agencies don't only touch the pages they were hired to redesign. Theme work often means edits to navigation, metafields, redirects, and app configuration along the way. A pricing project might touch collections, tags, or discount rules. None of that is necessarily a problem — but "necessarily" is doing a lot of work in that sentence if you can't see what happened.
Why this is hard without a change record
Shopify's own admin doesn't give you a clean, chronological view of what an account did across the store. You can check individual records — order notes, some page histories — but there's no single place to ask "show me everything this account touched, in order, with what it looked like before and after."
That gap is exactly why an audit log exists. Adminlog records changes across products, collections, pages, navigation, discounts, customers, and more as they happen, captured via Shopify's webhooks rather than reconstructed after the fact. By the time you're ready to revoke access, the record is already there — you're not scrambling to piece one together.
Honest actor attribution matters here specifically
The useful question isn't just "what changed" — it's "who changed it." When an agency has admin access, changes might come from a named staff account, from an app they installed on your behalf, or from an automation they configured. Those are different things, and conflating them makes the review less useful.
Adminlog attributes each change to staff, app, or system — and only when the underlying webhook data actually supports that attribution. It won't guess an actor it can't confirm. That distinction matters when you're trying to understand, for example, whether a product price change came from the agency's team directly or from a pricing app they connected. One is a decision you can ask about; the other might be a tool still running after they're gone.
Field-level diffs, not just "something changed"
A log entry that says "product updated" is barely more useful than no log at all. The question is always which field, from what, to what.
Adminlog records field-level before/after diffs, so a review of an agency's work isn't a guessing game. If a collection's sort order changed, you can see the old order and the new one. If a metafield was added, you can see exactly what was added and when. That level of detail is what turns "I think they changed some stuff" into an actual answer.
A practical review, before you revoke
None of this needs to be a forensic audit. For most agency offboardings, it's a short, practical pass:
1. Filter by actor
Start with the agency's staff account and any apps they installed or configured. This narrows the review to what's actually relevant instead of the store's entire change history.
2. Scan the entity types they'd plausibly have touched
Given the scope of the engagement — a theme project, a catalog cleanup, a discount campaign — check the entity types that map to it. You don't need to review every product if the work was confined to navigation and pages.
3. Read the diffs, not just the change count
A count of "47 changes" tells you very little. A handful of field-level diffs tells you whether those changes match what you expected from the engagement.
4. Decide what, if anything, to revert
Most of what you'll find is exactly what you asked for. Occasionally you'll find something that should be undone — a redirect that shouldn't have been added, a discount left active past its intended window. Adminlog's one-click revert makes that a quick fix rather than a manual rebuild, so this step doesn't become its own project.
Then revoke access
Once you've reviewed what changed, removing the agency's account is the easy part — and now it's an informed decision rather than a leap of faith. You're not hoping nothing was left behind; you've checked.
This isn't really about distrust. Most agency engagements end cleanly, and most changes are exactly what was scoped. But "probably fine" and "confirmed fine" are different levels of confidence, and the second one costs almost nothing when the record already exists.
A habit worth keeping
Reviewing agency changes before offboarding is a good moment to start using an audit log, but it works better as an ongoing habit than a one-time check. The same field-level view that helps you close out an agency engagement also helps when a staff member asks "did I actually change that price?" or when an app update quietly modifies more than expected.
If you're bringing on a new agency, or already have one wrapping up a project, it's worth having this visibility in place before the offboarding conversation — not scrambled together during it.