Audit log org settings events (#2564)

* Document granular org.settings.* audit log events

The single org.update_settings audit-log event was split into granular
org.settings.* events. Document the new event types and note that they
replace org.update_settings for filtering/parsing integrations.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* move tip

* comments from code review

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: SBrandeis

docs/hub/audit-logs.md

@@ -36,8 +36,24 @@ Each action has an **event name** in `scope.action` format (e.g. `repo.create`,
 
 ### Organization Management & Security
 
-- **Core organization changes** — Creation, deletion, restoration, renaming, and profile/settings updates.
-  - **Events:** `org.create`, `org.delete`, `org.restore`, `org.rename`, `org.update_settings`
+  > [!TIP]
+  > The **Settings changes** events below are only available for actions taken after June 16th, 2026. Events before that date use a unique `org.update_settings` event type. Any integration that filters or parses the event `type` field for orgs created before June 16th, 2026, should handle both.  
+
+- **Core organization changes** — Creation, deletion, restoration, and renaming.
+  - **Events:** `org.create`, `org.delete`, `org.restore`, `org.rename`
+- **Settings changes** — Updates to organization settings are recorded as granular `org.settings.*` events, so you can pinpoint exactly which setting changed.
+  - General settings — Profile, storage regions, resource groups, and publisher gating.
+  - **Events:** `org.settings.profile`, `org.settings.regions`, `org.settings.resource_groups`, `org.settings.publisher_gating`
+  - Inference providers — Provider configuration, API key add/remove, and usage settings.
+  - **Events:** `org.settings.inference_providers`, `org.settings.inference_providers.keys.add`, `org.settings.inference_providers.keys.remove`, `org.settings.inference_providers.usage`
+  - SSO — SSO configuration updates, and enabling or disabling SSO.
+  - **Events:** `org.settings.sso`, `org.settings.sso.enable`, `org.settings.sso.disable`
+  - Security — Default repository visibility, and enabling or disabling 2FA enforcement, automatic join, and member privacy.
+  - **Events:** `org.settings.security.repo_visibility`, `org.settings.security.2fa.enable`, `org.settings.security.2fa.disable`, `org.settings.security.auto_join.enable`, `org.settings.security.auto_join.disable`, `org.settings.security.members_privacy.enable`, `org.settings.security.members_privacy.disable`
+  - Network — Network configuration updates, and enabling or disabling IP access restriction and authentication enforcement.
+  - **Events:** `org.settings.network`, `org.settings.network.ip_restriction.enable`, `org.settings.network.ip_restriction.disable`, `org.settings.network.auth_enforcement.enable`, `org.settings.network.auth_enforcement.disable`
+
+  
 - **Security management**
   - Organization API token rotation.
   - **Event:** `org.rotate_token`