Directory Logs
3 minutes to readThe Directory logs allow you to monitor the history of user activities connected with their application access, credentials, and two-factor authentication (2FA). With Directory logs, you can view entries for the following event types triggered by user actions:
- 2FA setup – User configures the 2FA verification method.
- 2FA turn on – User activates 2FA.
- 2FA turn off – User deactivates 2FA.
- 2FA verification – User verifies their account with a security code from a mobile app.
- Application access – User accesses an app that is listed in the app connections for the directory.
- Password change – User changes the user portal password while logged in.
- Password recovery – User changes the user portal password through the password recovery flow.
- Sign-in with directory – User authenticates through the directory login page.
- Trusted browser for 2FA – User sets a browser as a trusted one for 2FA to avoid entering a 2FA verification code for a period of time.
The Directory logs contain the following information:
- Log ID – Unique ID of a log.
- Date – Date and time in the local time zone that can be configured in the account settings.
- Directory name – Directory in which an activity occurred.
- Activity ID – Unique identifier for an activity with the failure status.
- Activity type – The event category for which a log was created.
- Activity description – Summary of an activity.
- Status – Status of an activity, which is success or failure.
- Details – Description of an activity status.
- Directory ID – Unique ID of the directory in which an activity occurred.
- Application name – Name of the app in which a user was logged in or trying to log in when an activity occurred.
- Application ID – Unique ID of the app in which a user was logged in when an activity occurred.
- Performed by – First name, last name, and email of the user who triggered an activity.
- Performed by (user ID) – Unique identifier of the user who triggered an activity.
- Affected user – First name, last name, and email of the user whose record changed because of an activity.
- Affected user ID – Unique identifier of the user whose record changed because of an activity.
- Identity provider name – Name of an identity provider.
- Identity provider ID – Unique identifier of an identity provider.
- Source IP – App user IP address.
- Device type – Desktop, mobile, or tablet.
- Device – Name of a device brand.
- Browser – Name of an app user browser.
- Browser agent – Name of a browser agent.
- Location – App user location based on their IP.
