View and export audit logs

From the Dashboard page you can view and export audit logs. Authentication audit logs track authentications made to your IDaaS account by location, user, and authentication type. Management audit logs track actions performed in your IDaaS account by action and user.

Use these procedures to view and export audit logs.

tip

You can open prefiltered audit results from Dashboard > Authentication Activity by selecting an item in Top Applications or Top Authenticators.

View audit events

1. Click > Dashboard. The Dashboard page appears.
2. Click the Authentication or Management radio button to set the type of audit log you want to view.
3. Set the number of audits on a page:
   1. Scroll to the bottom of the page.
   2. From the Rows per page drop-down list, select the number of rows to display on the page.
   3. To move to a new page, on the right-hand side of the page, do the following, as required:
      • Click > to go to the next page.
      • Click < to go to the previous page.
      • Click |< to go to the first page.

View a specific audit event

1. Click > Dashboard. The Dashboard page appears.
2. Click the Authentication or Management radio button to set the type of audit log you want to view.
3. Click the row for the specific audit log you want to investigate.
4. Review Audit Event details in the right-side details drawer.
5. Optional. Use field-level quick actions in the drawer to view similar events by user, application, or event type.
6. Optional. Use the copy action in the drawer to copy all displayed event details.

View audit logs for specific users

1. Click > Members > Users. The Users List page appears.
2. Click the UserID of the user. The User Details page appears.

Audit data dictionary

Use the following table to review common fields that appear in audit records.

Event attribute	Description	Example
id	Unique ID for the event.	313b43e7-098a-4cc9-a6fd-a1ac1c703e53
eventTime	When the event happened in UTC time. The format is YYYY-MM-DDThh:mm:ssZ.	2016-08-21T14:27:55Z
eventCategory	The event category. Valid values are AUTHENTICATION or MANAGEMENT.	AUTHENTICATION
eventType	Identifies the source of the event. Valid AUTHENTICATION values are listed under Authentication events below. For MANAGEMENT actions, event types are built from the entity and action performed using the format <EntityType><EntityAction>Event where EntityType and EntityAction are capitalized.	AuthenticationDeniedEvent, AuthenticationOtpSuccessEvent, AuthenticationTokenSuccessEvent, AuthenticationTokenPushSuccessEvent, AuthenticationOtpEmailSentEvent, AuthenticationOtpSmsSentEvent, UsersAddEvent, ContextrulesEditEvent, ApplicationsRemoveEvent
accountId	The account UUID.	a6cb609f-c6ea-48ad-ab61-433b4054a1f8
subjectId	The subject identifier. The value depends on subjectType. For USER, this is the internal UUID for the user authenticating or the administrator performing a management action. For ADMIN_API, this is the UUID of the Admin API application. For Microsoft Entra ID Conditional Access authentication audits where a mapping to an IDaaS user is not found or validation fails, the value is a random UUID.	72fd8717-fffe-462f-83c6-131c12539af7
subjectName	The subject display name. The value depends on subjectType. For USER, this is the userId value of the user authenticating or the administrator performing a management action. For ADMIN_API, this is the Admin API application name. For Microsoft Entra ID Conditional Access authentication audits where a mapping to an IDaaS user is not found or validation fails, this is the Microsoft Entra ID-provided user value (for example, UPN).	lp1415@brawlers.es
subjectType	The type of subject. Common values include USER, ADMIN_API, SERVICE_PROVIDER, and AGENT.	USER
eventOutcome	The event outcome. Valid values are SUCCESS or FAIL.	SUCCESS
message	Message key indicating what the event did. For management actions, the key is built from the entity and action performed.	service_authentication.otp_sms_send, users.add
resourceId	The resource identifier (for example, an application UUID).	a6cb609f-c6ea-48ad-ab61-433b4054a1f8
resourceName	The resource name (for example, application name).	Salesforce
sourceIp	The request IP address, or IP address provided for authentication API applications.	1.23.47.122
eventVersion	Reserved for future use. Currently always v1.	v1
token	Depending on the stage at which the event is generated, this can be empty, the authentication type (OTP, TOKEN, TOKENPUSH), or the token serial number.	1234-5678
requiredPermission	Permission required to access a management entity. The permission is a tuple <entityType:entityAction> in lowercase.	users:add
subscriberRoleId	The role UUID used to access the Admin Portal management application.	775419bf-efff-467a-8743-e77930cc7ed9
subscriberRoleName	The subscriber role name.	Super Administrator
serviceProviderRoleId	The role UUID used to access the Service Provider management application.	a6cb609f-c6ea-48ad-ab61-433b4054a1f8
serviceProviderRoleName	The service provider role name.	Auditor
entityType	Identifies the business entity type. Valid values are listed under Entity types below.	USERS
entityAction	Identifies the action invoked on the entity. Valid values are ADD, EDIT, REMOVE, and VIEW. A few non-standard actions can appear (for example, ACTIVATE).	ADD
entityId	The entity UUID identifier.	a6cb609f-c6ea-48ad-ab61-433b4054a1f8
entityName	The entity name (for example, role name, group name, user ID).	Auditor, Contractors, jdoe
auditDetails	Additional audit details in JSON format. Possible attributes include messageTokens (reserved), modifiedEntityAttributes ([{name, oldValue, newValue}]), and entityAttributes ([{name, value}]). Values are event-specific.	See example JSON below.

Example auditDetails payload:

{
  "entityAttributes": [
    { "name": "Identity Provider", "value": "SP::twoco" },
    { "name": "Type", "value": "SP" },
    {
      "name": "Issuer",
      "value": "https://mycorp.us.trustedauth.com/api/oidc"
    }
  ],
  "messageTokens": null,
  "modifiedEntityAttributes": null
}

Risk-based authentication audit details

Authentication audit events can include the following risk-based authentication fields in auditDetails.entityAttributes:

Attribute	Description
ruleName	Resource rule selected for the request.
totalRiskPoint	Total configured risk points for the resource rule.
generatedRiskPoint	Risk points generated by the factor evaluations.
generatedRiskPointNormalized	Generated risk points normalized as a percentage.
riskLevel	Evaluated risk level.
authenticationFlow	Authentication flow selected for the evaluated risk level.
riskFactorEvaluationResults	Results recorded for the individual risk factor evaluations.

The following illustrative entityAttributes value shows a request where Geolocation passed and Travel Velocity generated risk points. Attribute values are strings. The value of riskFactorEvaluationResults is a JSON-encoded array within the audit payload.

{
  "entityAttributes": [
    {
      "name": "ruleName",
      "value": "Authentication API RBA example"
    },
    {
      "name": "totalRiskPoint",
      "value": "40"
    },
    {
      "name": "generatedRiskPoint",
      "value": "20"
    },
    {
      "name": "generatedRiskPointNormalized",
      "value": "50"
    },
    {
      "name": "riskLevel",
      "value": "MEDIUM"
    },
    {
      "name": "authenticationFlow",
      "value": "Password and second factor"
    },
    {
      "name": "riskFactorEvaluationResults",
      "value": "[{\"type\":\"LOCATION\",\"decision\":\"PERMIT\",\"riskPoints\":0,\"message\":\"service_authentication.in_allowed_countries\"},{\"type\":\"TRAVEL_VELOCITY\",\"decision\":\"DENY\",\"riskPoints\":20,\"message\":\"service_authentication.invalid_travel_velocity\"}]"
    }
  ]
}

A risk factor result of DENY means that the factor contributed its configured risk points. It does not necessarily mean that authentication was denied. The evaluated riskLevel and its configured authentication flow determine whether IDaaS permits authentication, requires stronger authentication, or denies access.

Audit event reference

Use the following lists to review supported entity types and authentication events that can appear in audit records.

Entity types

Entity type values are internal audit values; descriptions use current product terminology.

Service Provider account entities

Category	Entity type	Description
Account management	SERVICEPROVIDERS	Service provider accounts.
Account management	SERVICEPROVIDERACCOUNTS	Tenant accounts managed by a service provider.
Account management	CREATETENANT	Tenant account creation operations for service providers.
Account management	TENANTS	Tenant accounts managed by a service provider.
Account management	HOSTNAMESETTINGS	Hostname settings.
Entitlements	SPENTITLEMENTS	Service provider entitlements.
Identity providers	SPIDENTITYPROVIDERS	Service provider Identity Provider configuration.
OTP providers	OTPPROVIDERS	OTP provider configuration.
OTP providers	PREFERREDOTPPROVIDERS	Preferred OTP provider mappings.
Platform and credentials	SPCLIENTCREDENTIALS	Service provider client credentials.
Platform and credentials	SPMANAGEMENTPLATFORM	Service provider management platform configuration.
Platform and credentials	PKIAASCREDENTIALS	PKIaaS credentials.
Platform and credentials	PUSHCREDENTIALS	Push credential configuration.
Platform and credentials	PLAYINTEGRITYCREDENTIALS	Google Play Integrity credential configuration for Android custom application verification.
Policy and controls	RATELIMITING	Rate limiting policy configuration.
Roles and user management	SPROLES	Service provider administrator roles.
Roles and user management	USERSPROLES	Service provider role assignments for users.
Roles and user management	SPUSERMGMT	Service provider user management configuration.

IDaaS account entities

Category	Entity type	Description
Account configuration	SUBSCRIBERS	IDaaS account configuration.
Account configuration	SETTINGS	IDaaS account settings.
Account configuration	TEMPLATES	Application or notification templates.
Account configuration	CUSTOMIZATIONVARIABLES	Deprecated customization variables.
Account configuration	ENTITLEMENTS	IDaaS account entitlement configuration and usage.
Account configuration	USERATTRIBUTES	Custom user attribute configuration.
Administration	ROLES	Administrator roles in an IDaaS account.
Administration	USERSITEROLES	IDaaS account administrator role assignments for users.
Applications and access	APPLICATIONS	Applications configured for authentication or access.
Applications and access	CONTEXTRULES	Resource rules and contextual access rules.
Applications and access	AUTHENTICATIONFLOWS	Authentication flow configuration.
Applications and access	ACRS	Authentication context class references.
Applications and access	AUTHORIZATIONGROUPS	Authorization groups associated with users or access policy.
Applications and access	PASSTHROUGH	Passthrough authentication configuration.
Applications and access	IPLISTS	IP address lists used by access policy.
Applications and access	CLAIMS	OIDC/OAuth claim configuration.
Applications and access	RESOURCESERVERAPIS	OAuth resource server APIs.
Applications and access	RESOURCESERVERSCOPES	OAuth resource server scopes.
Applications and access	OAUTHROLES	OAuth role configuration and assignments.
Applications and access	USEROAUTHTOKENS	OAuth tokens associated with users.
Applications and access	IDENTITYPROVIDERS	Identity Provider configuration.
Applications and access	ORGANIZATIONS	Organization records used for SAML and OIDC/OAuth claims, organization selection, and membership.
Applications and access	WORKLOADIDENTITY	Workload identity records.
Authenticators	TOKENS	User token authenticators.
Authenticators	BULKHARDWARETOKENS	Bulk hardware token operations.
Authenticators	TEMPACCESSCODES	Temporary access code authenticators.
Authenticators	TEMPACCESSCODECONTENTS	Temporary access code contents.
Authenticators	GRIDS	Grid card authenticators.
Authenticators	GRIDCONTENTS	Grid card contents.
Authenticators	FIDOTOKENS	Passkey/FIDO2 authenticators.
Authenticators	OTPS	OTP records and OTP delivery actions.
Authenticators	USERMACHINES	Machines associated with users.
Authenticators	FACE	Face biometric configuration or activity.
Authenticators	USERPASSWORDS	User password records and password management actions.
Authenticators	NAMEDPASSWORDS	Named Password definitions and password policy configuration.
Authenticators	BLACKLISTEDPASSWORDS	Blocked password entries.
Authenticators	QUESTIONS	Knowledge-based authentication question definitions.
Authenticators	USERQUESTIONS	Knowledge-based authentication questions assigned to users.
Authenticators	USERQUESTIONANSWERS	Answers for user knowledge-based authentication questions.
Authenticators	USERKBACHALLENGES	Knowledge-based authentication challenge records.
Authenticators	WORDSYNONYMS	Word synonym records used by knowledge-based authentication.
Authenticators	TOKENACTIVATIONCONTENTS	Token activation content records.
Authenticators	MAGICLINKS	Magic Link authenticator, registration link, and password reset link configuration and delivery actions.
Authenticators	MAGICLINKCONTENTS	Magic Link content records.
Bulk and migration	BULKUSERS	Bulk user operations.
Bulk and migration	BULKGROUPS	Bulk group operations.
Bulk and migration	BULKIDENTITYGUARD	Bulk Identity Enterprise migration operations.
Certificates and credentials	CAS	Certificate authority configuration.
Certificates and credentials	CERTIFICATES	Certificates used by applications or integrations.
Certificates and credentials	DIGITALIDCONFIGS	Digital ID configuration.
Certificates and credentials	DIGITALIDCONFIGVARIABLES	Variables used by Digital ID configuration.
Certificates and credentials	DIGITALIDCONFIGCERTTEMPS	Certificate templates used by Digital ID configuration.
Certificates and credentials	DIGITALIDCONFIGSANS	Subject alternative name settings used by Digital ID configuration.
Certificates and credentials	SCDEFNS	Smart Credential definitions.
Certificates and credentials	SCDEFNPIVAPPLETCONFIGS	PIV applet settings for Smart Credential definitions.
Certificates and credentials	SCDEFNVARIABLES	Variables used by Smart Credential definitions.
Certificates and credentials	SMARTCREDENTIALS	Smart Credentials assigned to users.
Certificates and credentials	SMARTCREDENTIALSSIGNATURE	Smart Credential signing transactions.
Certificates and credentials	BULKSMARTCARDS	Bulk smart card operations.
Certificates and credentials	SMARTCARDS	Smart card records.
Certificates and credentials	DOMAINCONTROLLERCERTS	Domain controller certificates.
Certificates and credentials	DIGITALIDCERTIFICATES	Digital ID certificates.
Certificates and credentials	PIVCONTENTSIGNER	PIV content signer configuration.
Directories and provisioning	DIRECTORIES	Directory integrations.
Directories and provisioning	DIRECTORYSYNC	Directory synchronization configuration and activity.
Directories and provisioning	DIRECTORYCONNECTIONS	Directory connection settings.
Directories and provisioning	AD_CONNECTOR_DIRECTORIES	Active Directory connector directory configuration.
Directories and provisioning	AZURE_DIRECTORIES	Microsoft Entra ID directory configuration.
Directories and provisioning	DIRECTORYPASSWORD	Directory password configuration or actions.
Directories and provisioning	DIRECTORYSEARCHATTRIBUTES	Directory search attribute configuration.
Directories and provisioning	DIRECTORYATTRIBUTES	Directory attribute configuration.
Directories and provisioning	HIGH_AVAILABILITY_GROUPS	High availability groups for AD Connector directory configuration.
Directories and provisioning	SCIMPROVISIONINGS	SCIM provisioning configuration.
Directories and provisioning	SENDSCIM	SCIM delivery or synchronization actions.
Directories and provisioning	SENDAZUREAD	Microsoft Entra ID delivery or synchronization actions.
Notifications and messaging	EMAILTEMPLATES	Email template configuration.
Notifications and messaging	EMAILVARIABLES	Email template variables.
Notifications and messaging	SENDEMAIL	Email delivery actions.
Notifications and messaging	CONTACTVERIFICATION	Contact verification records and actions.
Policy and risk	EXPECTEDLOCATIONS	Expected user location records used by risk policy.
Policy and risk	USERLOCATIONS	User location records used by risk policy.
Policy and risk	USERRBASETTINGS	User-specific risk-based authentication settings.
Policy and risk	GROUPPOLICIES	Group policy configuration.
Policy and risk	POLICYOVERRIDE	Policy override audit records, such as administrator actions that override a user's group policy settings.
Policy and risk	RISKENGINES	External risk engine configuration.
Policy and risk	TRANSACTIONITEMS	Transaction item records.
Policy and risk	TRANSACTIONRULES	Transaction rule configuration.
Reports and audit operations	REPORTS	Generated reports and report actions.
Reports and audit operations	EXPORTREPORTS	Exported reports.
Reports and audit operations	ARCHIVES	Audit archive files.
Reports and audit operations	SCHEDULEDTASKS	Scheduled automated tasks, such as report generation.
User data	USERS	User accounts and user profile records.
User data	GROUPS	User groups.
User data	USERATTRIBUTEVALUES	Custom user attribute values assigned to users.
User data	INTELLITRUSTDESKTOPS	Desktop client configuration.
User data	ACTIVESYNC	ActiveSync configuration.
User data	IDPROOFING	Identity proofing configuration or activity.
User data	IDPROOFINGLICENSE	Identity proofing license configuration.
User verification	VERIFYUSER	Admin Verify User operation.
Verifiable credentials	VCDEFNS	Verifiable credential definitions.
Verifiable credentials	VCS	Verifiable credentials.
Verifiable credentials	VPDEFNS	Verifiable presentation definitions.
Webhooks	WEBHOOKS	Webhook configuration.
Webhooks	WEBHOOK_NOTIFICATION	Webhook notification delivery records.

Management events

Management event types are derived from the entity type and action. For standard management actions, IDaaS uses the format <EntityType><EntityAction>Event, where EntityType and EntityAction are converted to lowercase and then capitalized.

Action	Event type pattern	Description
ADD	<EntityType>AddEvent	An administrator or authorized process added the entity.
EDIT	<EntityType>EditEvent	An administrator or authorized process changed the entity.
REMOVE	<EntityType>RemoveEvent	An administrator or authorized process removed the entity.
VIEW	<EntityType>ViewEvent	An administrator or authorized process viewed the entity.
ALL	<EntityType>AllEvent	A role or permission grants all available actions for the entity.

For example, USERS with ADD appears as UsersAddEvent, and APPLICATIONS with REMOVE appears as ApplicationsRemoveEvent.

Some management workflows use custom actions in addition to the standard actions. Use the following table to review custom management event types found in audit records.

Event type	Description
CreatetenantResultsEvent	A tenant account creation result was recorded.
DigitalidcertificatesHoldEvent	A digital ID certificate was placed on hold.
DigitalidcertificatesRevokeEvent	A digital ID certificate was revoked.
DigitalidcertificatesUnholdEvent	A digital ID certificate hold was removed.
DirectorysyncCrawlEvent	Directory synchronization crawl activity was recorded.
FaceEmailEvent	Face biometric email delivery was attempted. Check the event outcome to determine whether delivery succeeded or failed.
GatewaysRegistercompleteEvent	Gateway registration was completed.
GridsAssignEvent	A grid card was assigned.
GridsChangestateEvent	A grid card state changed.
GridsRemovedEvent	A grid card was removed.
GridsSelfassignEvent	A user self-assigned a grid card.
GridsUnassignEvent	A grid card was unassigned.
GroupsSyncaddEvent	Directory synchronization added a group.
GroupsSyncdeleteEvent	Directory synchronization deleted a group.
GroupsSynclocalizeEvent	Directory synchronization localized a group.
MagiclinksEmailEvent	Magic link email delivery was attempted. Check the event outcome to determine whether delivery succeeded or failed.
OrganizationsAdduserEvent	A user was added to an organization.
OrganizationsRemoveuserEvent	A user was removed from an organization.
RatelimitingRemovetenantpolicyEvent	An IDaaS account rate-limiting policy was removed.
RatelimitingSettenantpolicyEvent	An IDaaS account rate-limiting policy was set.
SendemailToken_renewEvent	Email service OAuth token renewal was recorded. Check the event outcome to determine whether renewal succeeded or failed.
SendscimToken_renewEvent	SCIM OAuth token renewal was recorded. Check the event outcome to determine whether renewal succeeded or failed.
SmartcardsCreateEvent	A smart card was created.
SmartcardsLoadEvent	Smart card load activity was recorded.
SmartcredentialsActivateEvent	A Smart Credential was activated.
SmartcredentialsChangestateEvent	A Smart Credential state changed.
SmartcredentialsRevokeEvent	A Smart Credential was revoked.
SmartcredentialsUnassignEvent	A Smart Credential was unassigned.
SmartcredentialsUnblockEvent	A Smart Credential was unblocked.
SmartcredentialsUnholdEvent	A Smart Credential hold was removed.
SmartcredentialssignatureNo_transactionEvent	Smart Credential signature could not continue because no transaction was available.
SmartcredentialssignatureStartsignEvent	Smart Credential signing started.
SmartcredentialssignatureTransaction_expiredEvent	Smart Credential signing failed because the transaction expired.
SmartcredentialssignatureTransaction_invalidEvent	Smart Credential signing failed because the transaction was invalid.
SmartcredentialssignatureUser_cancel_responseEvent	Smart Credential signing was canceled by the user.
SmartcredentialssignatureUser_concern_responseEvent	Smart Credential signing recorded a user concern response.
SmartcredentialssignatureUser_confirm_responseEvent	Smart Credential signing was confirmed by the user.
SubscribersLoginlayoutresetEvent	Subscriber login layout settings were reset.
SubscribersThemeresetEvent	Subscriber theme settings were reset.
TenantsEmaildeliveryEvent	Tenant account email delivery was attempted. Check the event outcome to determine whether delivery succeeded or failed.
TenantsLockEvent	A tenant account was locked.
TenantsPromotetoserviceproviderEvent	A tenant account was promoted to a service provider account.
TenantsResetmailserverEvent	A tenant account mail server was reset.
TenantsResetresourcerulesEvent	A tenant account resource rule configuration was reset.
TenantsUnlockEvent	A tenant account was unlocked.
TenantsUnlockadminsEvent	Tenant account administrator users were unlocked.
TokensActivateEvent	A token was activated.
TokensActivatecompleteEvent	Token activation completed.
TokensActivateonlinebeginEvent	Online token activation started.
TokensActivateonlinecompleteEvent	Online token activation completed.
TokensAssignEvent	A token was assigned.
TokensChangestateEvent	A token state changed.
TokensLoadEvent	Token load activity was recorded.
TokensRemovedEvent	A token was removed.
TokensResetEvent	A token was reset.
TokensRotateseedEvent	A token seed was rotated.
TokensSelfassignEvent	A user self-assigned a token.
TokensUnassignEvent	A token was unassigned.
TokensUnlockEvent	A token was unlocked.
UserpasswordsEmailexpirynotificationEvent	Password expiry email notification delivery was attempted. Check the event outcome to determine whether delivery succeeded or failed.
UserpasswordsSmsexpirynotificationEvent	Password expiry SMS notification delivery was attempted. Check the event outcome to determine whether delivery succeeded or failed.
UsersAddcontactEvent	A user contact was added.
UsersChangestateEvent	A user state changed.
UsersDeletecontactEvent	A user contact was deleted.
UsersLockEvent	A user was locked.
UsersModifycontactEvent	A user contact was modified.
UsersSyncaddEvent	Directory synchronization added a user.
UsersSyncdeleteEvent	Directory synchronization deleted a user.
UsersSynclocalizeEvent	Directory synchronization localized a user.
UsersUnlinkEvent	A user was unlinked from a synchronized directory source.
UsersUnlockEvent	A user was unlocked.
UsersUser_registration_completeEvent	User registration completed.
UsersWechat_openid_registration_auth_code_failureEvent	WeChat OpenID registration failed because of an authorization code failure.
UsersWechat_openid_registration_callbackEvent	WeChat OpenID registration callback activity was recorded.
UsersWechat_openid_registration_completeEvent	WeChat OpenID registration completed.
UsersWechat_openid_registration_initEvent	WeChat OpenID registration started.
VerifyuserVerifyEvent	Verify User activity was recorded. Check the event outcome and audit details for the authenticator and result.

Authentication events

Use the following table to review supported authentication event types.

Event type	Description
AuthenticationDeniedEvent	Authentication failed or access was denied. The token field can identify the authenticator involved.
VerificationDeniedEvent	Identity verification failed or was denied.
VerificationIdpSuccessEvent	Identity verification with an Identity Provider succeeded.
VerificationFaceSuccessEvent	Face verification succeeded.
VerificationFaceFailedEvent	Face verification failed.
EntrustIdentityVerificationSuccessEvent	Entrust identity verification succeeded.
EntrustIdentityVerificationFailedEvent	Entrust identity verification failed.
AuthenticationOtpUnavailableEvent	OTP authentication could not continue because the user has no available OTP delivery contact, such as a mobile number, phone number, email address, or external OTP contact.
AuthenticationExternalSuccessEvent	Authentication with an external authenticator succeeded.
AuthenticationExternalSecondFactorBypassEvent	Authentication with an external authenticator succeeded and the configured second-factor requirement was bypassed.
AuthenticationOtpSentToAllEvent	OTP delivery to all available user contacts was attempted. Check the event outcome to determine whether delivery succeeded or failed.
AuthenticationOtpEmailSentEvent	An authentication OTP was sent by email.
AuthenticationOtpNoCreditEvent	SMS or voice OTP delivery could not continue because the account did not have enough OTP credits.
AuthenticationOtpSmsSentEvent	An authentication OTP was sent by SMS.
AuthenticationOtpVoiceSentEvent	An authentication OTP was sent by voice call.
AuthenticationOtpWeChatSentEvent	An authentication OTP was sent by WeChat, or WeChat delivery was attempted and failed. Check the event outcome and audit details.
AuthenticationOtpWeChatFetchMessageAccessTokenFail	WeChat OTP delivery failed because IDaaS could not fetch the WeChat message access token.
AuthenticationOtpWhatsappSentEvent	An authentication OTP was sent by WhatsApp, or WhatsApp delivery was attempted and failed. Check the event outcome and audit details.
AuthenticationOtpCreatedEvent	An authentication OTP was created for the user.
AuthenticationLockedEvent	Authentication was blocked because the user or authenticator was locked.
UserPasswordChangeLockedEvent	A mobile password change attempt was blocked because the password authenticator or user was locked, or the failed attempt caused lockout.
UserPasswordChangeFailedEvent	A mobile password change failed because the supplied current password did not match the existing password.
UserStepUpAuthenticationSuccess	The user successfully completed step-up authentication for the user portal edit profile flow.
SamlAuthenticationFailedEvent	SAML authentication failed.
SamlAuthenticationSuccessEvent	SAML authentication succeeded.
OidcAuthenticationFailedEvent	OIDC authentication failed.
OidcAuthenticationSuccessEvent	OIDC authentication succeeded.
WorkloadClientCredentialsSuccessEvent	A workload identity successfully authenticated with the OAuth 2.0 client credentials flow.
WorkloadClientCredentialsFailedEvent	A workload identity failed to authenticate with the OAuth 2.0 client credentials flow.
MachineLockedEvent	Machine authentication was blocked because the machine was locked.
AuthenticationAdminApiSuccessEvent	Authentication for an Admin API request succeeded.
AuthenticationMagicLinkSuccessEvent	Magic link authentication succeeded.
AuthenticationPasswordSuccessEvent	Password authentication succeeded.
AuthenticationKbaSuccessEvent	Knowledge-based authentication succeeded.
AuthenticationTempAccessCodeSuccessEvent	Temporary access code authentication succeeded.
AuthenticationOtpSuccessEvent	OTP authentication succeeded.
AuthenticationOtpWithTempAccessCodeSuccessEvent	OTP authentication succeeded by using a temporary access code as the alternative authenticator.
AuthenticationGridSuccessEvent	Grid card authentication succeeded.
AuthenticationGridWithTempAccessCodeSuccessEvent	Grid card authentication succeeded by using a temporary access code as the alternative authenticator.
AuthenticationTokenSuccessEvent	Token authentication succeeded.
AuthenticationTokenWithTempAccessCodeSuccessEvent	Token authentication succeeded by using a temporary access code as the alternative authenticator.
AuthenticationTokenCRSuccessEvent	Challenge-response token authentication succeeded.
AuthenticationTokenPushSuccessEvent	Token push authentication succeeded.
AuthenticationFIDOSuccessEvent	FIDO authentication succeeded.
AuthenticationPasskeySuccessEvent	Passkey authentication succeeded.
AuthenticationSmartCredentialPushSuccessEvent	Smart Credential push authentication succeeded.
AuthenticationSmartLoginSuccessEvent	Smart login authentication succeeded.
AuthenticationUserCertificateSuccessEvent	User certificate authentication succeeded.
AuthenticationPassthroughSuccessEvent	Passthrough authentication succeeded.
AuthenticationIdpSuccessEvent	Identity Provider authentication succeeded.
AuthenticationFaceSuccessEvent	Face authentication succeeded.
AuthenticationFirstFactorPasswordSuccessEvent	Password authentication succeeded as the first factor in a multi-factor flow.
AuthenticationFirstFactorExternalSuccessEvent	External authentication succeeded as the first factor in a multi-factor flow.
AuthenticationFirstFactorIdpSuccessEvent	Identity Provider authentication succeeded as the first factor in a multi-factor flow.
AuthenticationSecondFactorKbaSuccessEvent	Knowledge-based authentication succeeded as the second factor.
AuthenticationSecondFactorTempAccessCodeSuccessEvent	Temporary access code authentication succeeded as the second factor.
AuthenticationSecondFactorOtpSuccessEvent	OTP authentication succeeded as the second factor.
AuthenticationSecondFactorOtpWithTempAccessCodeSuccessEvent	OTP authentication succeeded as the second factor by using a temporary access code as the alternative authenticator.
AuthenticationSecondFactorGridSuccessEvent	Grid card authentication succeeded as the second factor.
AuthenticationSecondFactorGridWithTempAccessCodeSuccessEvent	Grid card authentication succeeded as the second factor by using a temporary access code as the alternative authenticator.
AuthenticationSecondFactorTokenSuccessEvent	Token authentication succeeded as the second factor.
AuthenticationSecondFactorTokenWithTempAccessCodeSuccessEvent	Token authentication succeeded as the second factor by using a temporary access code as the alternative authenticator.
AuthenticationSecondFactorTokenCRSuccessEvent	Challenge-response token authentication succeeded as the second factor.
AuthenticationSecondFactorTokenPushSuccessEvent	Token push authentication succeeded as the second factor.
AuthenticationSecondFactorFIDOSuccessEvent	FIDO authentication succeeded as the second factor.
AuthenticationSecondFactorUserCertificateSuccessEvent	User certificate authentication succeeded as the second factor.
AuthenticationSecondFactorSmartCredentialPushSuccessEvent	Smart Credential push authentication succeeded as the second factor.
AuthenticationSecondFactorFaceSuccessEvent	Face authentication succeeded as the second factor.
AuthenticationSecondFactorPassthroughSuccessEvent	Passthrough authentication succeeded as the second factor.
AuthenticationSecondFactorMagicLinkSuccessEvent	Magic link authentication succeeded as the second factor.
AuthenticationAllowedCompromisedPasswordDetectedEvent	A compromised password was detected during authentication, but policy allowed the sign-in to continue.
AuthenticationForceChangeCompromisedPasswordDetectedEvent	A compromised password was detected during authentication, and policy required the user to change the password.
ModifyContactOtpSmsSentEvent	An OTP was sent by SMS to verify a contact during contact modification.
ModifyContactOtpVoiceSentEvent	An OTP was sent by voice call to verify a contact during contact modification.
ModifyContactOtpEmailSentEvent	An OTP was sent by email to verify a contact during contact modification.
ModifyContactOtpWeChatSentEvent	An OTP was sent by WeChat to verify a contact during contact modification.
ModifyContactOtpWhatsappSentEvent	An OTP was sent by WhatsApp to verify a contact during contact modification.
VerifyUserSuccessUserResponseEvent	Verify User completed successfully after the user submitted the expected response.
VerifyUserInvalidUserResponseEvent	Verify User failed because the user submitted an invalid response.
PushAuthenticationDeliveryFailedEvent	Push authentication delivery failed before the user could complete the push challenge.

Audit details

Use the following lists to review the audit detail fields available for the listed authentication success events.

SamlAuthenticationSuccessEvent

• Application Name
• SP/IDP Initiated (IDP or SP)
• SP Issuer
• Name ID
• ACR URL
• Organization ID
• Organization Name

OidcAuthenticationSuccessEvent

• Client ID
• Application Name
• Response Types
• ID Token Subject
• Redirect URI
• ACR
• AMR
• Organization ID
• Organization Name