# Easy CMS roles, single sign-on and audit log for teams

> Roles you tick in the admin, sign-in with Google, Microsoft or GitHub, and a signed audit log of who changed what: Easy CMS 0.33 to 0.36.

URL: https://easycms.dev/blog/roles-single-sign-on-and-an-audit-log  
Published: 2026-10-05  
Updated: 2026-10-29

A CMS for one developer can trust everyone who logs in. A CMS for a team can't. Four releases, 0.33 to 0.36, add what a team needs, and each is off until you turn it on.

## Roles from the admin

```ts
auth: { rbac: true },
```

Admins get Settings → Roles: add a role and tick Read, Create, Update, Delete and Publish per collection and global, plus admin pages. Permissions are checked on the server on top of your access rules, so both must allow. When roles are first turned on, they keep everything they could do before; nothing changes until an admin unticks something.

0.34 adds the details teams ask for next:

- \*\*Own documents only:\*\* writers read every post but change, publish and delete only theirs.
- \*\*Field permissions:\*\* per role, each field can be editable, read only or hidden.
- \*\*Deleting a user\*\* asks who gets the documents they owned.

## Single sign-on

The new `@easy-cms/auth-oauth` package adds "Sign in with…" for Google, Microsoft (Entra ID), GitHub or any OpenID Connect provider.

```ts
import { google } from '@easy-cms/auth-oauth'

auth: { providers: [google()] }, // reads GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET
```

`auth.allowSignUp` gives people from your domains an account on their first sign-in, and `auth.password: false` keeps passwords for admins only.

## An audit log

With `audit: true`, Easy CMS records changes to documents (each field's value before and after), sign-ins, failed logins, roles, backups and deliveries, with who, how and from where. Settings → Audit log has filters and CSV export. Entries can't be edited through Easy CMS, each is signed with the secret, and a daily check finds edited or missing ones.

Each of these adds a table: create a migration when you turn it on. The Roles, Single sign-on and Audit log guides have the details.