Apple Home Activity History can help explain who changed a supported lock, alarm, garage door, or sensor state, but it is not a permanent security archive. Apple says the Home app can show up to 30 days of supported accessory activity. That makes it useful for a short operating review, not a replacement for alarm event records, camera exports, or an incident timeline.
This 2026 audit turns the feature into a repeatable home-security check. You will confirm that the right accessories appear, test how named and unattributed actions are recorded, review who can read the history, document the retention limit, and prove what happens when a hub, network, phone, or resident account is unavailable.
Apple Home Activity History at a glance
| Question | What to verify | Why it matters |
|---|---|---|
| Is Activity History available? | Open Home Settings, then Safety & Security, and confirm the Activity History control appears. | Do not build a response plan around a menu or accessory state your home does not expose. |
| Which accessories report events? | List each supported lock, garage door, alarm, contact sensor, smoke detector, door, or window that appears in your Home. | A missing device creates a gap that the history cannot explain. |
| How long is the record kept? | Record the current retention shown by Apple and the oldest event visible in your Home. | Apple describes up to 30 days, so older events may no longer be available. |
| Who can see it? | Test the owner and each resident role from their own device. | History can expose household routines, entry times, and alarm changes. |
| Can each action be attributed? | Compare a named resident action, an automation, a physical action, and an accessory-app action. | Not every event necessarily identifies a person or the full control path. |
| What is the fallback record? | Choose a vendor event log, alarm record, camera clip, or written incident timeline for gaps. | One Home app feed should not carry the whole evidence job. |
Start with Apple’s current scope
Use Apple’s current support page, View smart home accessory activity in the Home app, as the feature baseline. Apple describes up to 30 days of activity for supported accessories such as door locks, alarm systems, and smoke detectors. The exact list and screen can depend on the home setup, accessory support, software version, and current Home architecture.
The Mac Home guide also documents the Activity History control in Safety & Security. If the setting or expected events do not appear, stop and diagnose that gap before treating the feature as part of your response plan. A marketing claim, a Matter logo, or a generic “Works with Apple Home” badge does not prove that every accessory event you care about will be listed.
Keep three records separate
- Control history: who or what changed a supported state in Apple Home.
- Security response record: alarm events, monitoring calls, dispatch notes, and zone details from the security provider.
- Incident evidence: camera clips, still images, exports, receipts, and a written timeline.
Activity History is strongest as the first record. If you are investigating a real event, build a separate home-security incident timeline and preserve source records before their own retention windows expire.
Build an accessory and event inventory
Create one row for every security-relevant accessory in the Home app. Use the exact room, accessory name, manufacturer, model, connection path, and security job. Avoid labels such as “Door” or “Sensor” when the property has several. Clear names make a short history easier to read under pressure.
| Accessory | Security job | Expected event | Home history seen? | Second record |
|---|---|---|---|---|
| Front entry lock | Access control | Lock, unlock, person or path when available | Pass / fail | Lock maker’s log |
| Garage door | Vehicle and interior entry | Open and close | Pass / fail | Controller history or camera |
| Alarm system | Intrusion warning and response | Arm, disarm, triggered state when supported | Pass / fail | Alarm event record |
| Patio contact sensor | Perimeter state | Open and close | Pass / fail | Alarm zone log |
| Smoke detector | Life-safety warning | Alarm or state change when supported | Pass / fail | Detector and monitoring record |
Take a screenshot of the completed inventory, not of private codes or keys. Record the audit date and software versions. If an accessory is renamed, moved to another room, replaced, or reset, add the change to a home-security system change log. Otherwise, an older event may be hard to match to the current device name.
Map every control path before testing
A lock or alarm may be controlled through more than one path. Activity History may not describe each path in the same way. List them first:
- Home app tap by the owner.
- Home app tap by another resident.
- Siri request from a phone, watch, speaker, or TV.
- Home automation, scene, or schedule.
- Physical key, keypad, thumbturn, alarm panel, or garage wall control.
- Manufacturer app or cloud service.
- Home Key, guest code, or another credential supported by the exact lock.
Do not assume an event identifies the operator merely because the state changed. Your test needs to distinguish “the lock unlocked” from “this named person unlocked it by this path.” Where attribution is missing, write that limit into the operating record.
Run a controlled attribution test
Choose a quiet period. Tell everyone in the home that you are testing. Do not trigger a monitored alarm, a smoke alarm, or an emergency response unless the provider has placed the system in a documented test mode.
- Write the exact local time and time zone.
- Have the owner change one safe accessory state from the Home app.
- Wait for the event to appear and record the displayed wording and attribution.
- Return the accessory to its safe state.
- Repeat from one resident’s device.
- Repeat with one automation or scene that can be tested without reducing protection.
- Repeat with the physical control, such as a thumbturn, while another responsible adult keeps the entry secure.
- If the manufacturer app is a normal control path, test one action there.
- Compare the Home record with the accessory maker’s record and your written timestamps.
Use a one-minute pause between actions so adjacent events are easy to distinguish. If the Home app shows a generic event, mark it “state confirmed, operator not confirmed.” Do not fill in an identity from memory.
Audit who can read the history
Apple’s current guide for inviting people to control Home accessories describes owner, resident, and guest access choices. Review the exact roles shown in your current Home app rather than copying an old permission diagram.
From each invited person’s device, test whether Activity History is visible and whether sensitive accessories can be controlled. Record the result. Entry and alarm history can reveal when residents leave, arrive, sleep, or disable a system. Give ongoing Home access only to people who need it.
Resident review worksheet
| Person | Role shown | Remote access | Can view history? | Can change security accessories? | Review date |
|---|---|---|---|---|---|
| Owner | Owner | Yes / no | Yes / no | List exact devices | Date |
| Resident A | Resident | Yes / no | Yes / no | List exact devices | Date |
| Guest or temporary user | Guest / code only / none | Yes / no | Yes / no | List exact devices | End date |
When someone leaves the household, use a full HomeKit member-removal checklist. Then review vendor accounts, alarm users, lock codes, Home Keys, and shared camera access. Removing a person from one app does not prove every other credential has been revoked.
Confirm time, naming, and retention
An activity record is only useful if you can match it to other sources. Compare one tested event across Apple Home, the vendor app, camera time, alarm history, and your phone clock. Record time zone and daylight-saving status. If times disagree, follow a HomeKit time-zone and daylight-saving audit before relying on a sequence.
Apple describes a rolling window of up to 30 days, not permanent storage. Write the oldest date visible during the test. If your response policy needs longer retention, choose where records will be exported or documented. Do not wait until day 31 to discover the event you need is gone.
Retention rule
- Review recent access and alarm-state changes on a set weekly day.
- Escalate unexplained changes immediately.
- For a real incident, preserve separate source records according to legal, insurance, and privacy needs.
- Do not copy routine household movements into a permanent shared file without a clear need.
Test notifications separately from history
A history entry does not prove anyone received an alert. Open a supported door or change a safe test state, then check both the Activity History entry and the expected notification route. Test the owner and backup responder. Repeat with the phone locked and with the normal Focus mode enabled.
If the event appears but the alert does not, use the HomeKit notification reliability checklist. If the alert arrives but the event is missing, investigate the accessory’s history support, home hub, software, and control path.
Test failure states without weakening protection
Run only failures that can be controlled and reversed. Keep a mechanical entry method, an adult inside, and any monitored alarm in its approved test state.
| Failure | Safe test | Pass condition | Fallback |
|---|---|---|---|
| Phone offline | Turn off Wi-Fi and cellular on the test phone after confirming another administrator is available. | Local safety and physical entry still work; later history behavior is documented. | Second phone, local control, physical key. |
| Internet outage | Use a short planned router disconnect while the home is occupied. | Local accessory behavior and alarm safety are known; remote limits are recorded. | Alarm cellular path, local siren, keyholder. |
| Home hub unavailable | Test one hub at a time only if another supported hub and local entry path are ready. | The team knows which history, remote control, and automation functions change. | Backup hub, vendor app, local controls. |
| Accessory bridge unavailable | Power down the exact bridge briefly during a low-risk window. | Missing events and recovery time are measured; alarm protection is not assumed. | Vendor record, direct alarm zone, manual check. |
| Resident account removed | Use a test resident or a real offboarding event, never an owner account without recovery proof. | Access ends where expected and remaining administrators retain control. | Backup administrator and vendor support path. |
After every failure, restore the network or device, confirm the accessory is online, run one fresh event, and check whether the timeline resumes. Record gaps honestly. A later event does not backfill every missed state change.
Investigate an unexplained event
- Do not delete users, reset devices, or rename accessories before preserving the current records.
- Capture the event time, wording, accessory name, and attribution exactly as displayed.
- Check the manufacturer app, alarm log, camera event, monitoring contact, and household change log.
- Ask residents about physical controls, voice commands, scenes, schedules, and temporary codes.
- Review smart-lock credentials with the smart-lock access-code audit.
- If an alarm was involved, record zone, verification, and response details in the false-alarm log or incident file.
- If unauthorized access is plausible, secure entry and accounts first, then preserve evidence and contact the relevant provider or authority.
A history mismatch is a signal to investigate, not proof of misconduct. Device clocks, naming, local controls, automations, bridge delays, and unsupported attribution can all change what appears.
Run the 60-minute Apple Home Activity History audit
- Minutes 0–10: Confirm the setting, current retention window, home hub status, and backup administrator.
- Minutes 10–20: Build the accessory inventory and mark which security devices appear in history.
- Minutes 20–35: Test owner, resident, automation, physical, and vendor-app control paths on safe accessories.
- Minutes 35–45: Check resident visibility, remote access, and the current user list.
- Minutes 45–52: Compare timestamps and attribution with a second record.
- Minutes 52–57: Test one controlled phone, network, hub, or bridge failure.
- Minutes 57–60: Restore normal operation, run a final event, close gaps, and schedule the next review.
Do not rely on Activity History until these blockers are cleared
- The Activity History setting is absent or disabled and the reason is unknown.
- A lock, alarm, garage door, contact sensor, or smoke detector you depend on does not produce the expected entry.
- No second record exists for alarm response or incident evidence.
- Former residents, contractors, or guests retain Home, vendor-app, lock-code, or camera access.
- Accessory names are ambiguous or timestamps cannot be matched across systems.
- The only owner account has no tested recovery or backup administrator.
- A history entry is being treated as proof that an alert was delivered.
- The 30-day window is shorter than the household’s review or evidence need and no preservation process exists.
Bottom line
Apple Home Activity History is a useful short-window control record when supported accessories, people, naming, time, and fallback evidence are all tested. Its value comes from knowing what it records and what it does not. Keep alarm response, camera evidence, vendor logs, and a written incident timeline as separate layers.
Frequently asked questions
How far back does Apple Home Activity History go?
Apple’s current support page describes up to 30 days for supported smart-home accessory activity. Confirm the oldest visible event in your own Home because availability and setup can change.
Does an activity entry prove who opened a door?
No. Some actions may identify a person or control path, while others may show only a state change. Compare the entry with the lock maker’s log, camera record, alarm event, and resident test.
Is Activity History a replacement for a monitored alarm log?
No. Alarm response, monitoring calls, zone records, dispatch notes, and incident evidence have separate jobs and should be preserved separately.
Can a resident see household activity?
Permissions and current Home behavior must be checked from that resident’s own device. Treat entry and alarm history as sensitive routine data and grant access only when needed.
What should I do if an expected event is missing?
Check exact accessory support, Home and vendor software, hub and bridge status, network state, naming, and the control path used. Record the gap and keep a second event source.
