This site requires JavaScript to be enabled
External Customer KB > General > Events
Events
Article: KB0010422 Published: 09/29/2023 Last modified: 09/29/2023

The events log monitors everything that happens within your organization's OneLogin, from individual user actions to administrative operations, provisioning, and MFA device registration.

 


 

Managing Events

To view the Events page, sign in to your OneLogin admin portal and go to Activity > Events.

Events

Use the dropdown menus at the top of the Events log to filter for events by user, event type, status, or risk. For example, you might search for a list of each time that a rule was applied to a specific user, or any user logins that resulted in a high risk score.

Event Filters

If you have SmartFactor Authentication enabled, risk is calculated from a variety of factors such as location and IP address, assigned a score on a scale of 0-100, and sorted into four levels of No, Low, Medium, and High risk. Without Smart MFA, the filter is still present on your Events page, but risk scores are not calculated and the risk filter will not return any results.

Click any event to view specific information such as the user, IP address, time and date, and additional details depending on the type of event.

Event Details

 


 

List of Events

These are all event types that are currently tracked in the OneLogin admin portal:

Apps

Actor_user manually added user to app
Actor_user manually removed user from app
Api - app rules apply for app failed
Api - app rules apply for app success
Api - app rules create for app failed
Api - app rules create for app success
Api - app rules delete for app failed
Api - app rules delete for app success
Api - app rules dryrun for app failed
Api - app rules dryrun for app success
Api - app rules get for app failed
Api - app rules get for app success
Api - app rules list action values for app failed
Api - app rules list action values for app success
Api - app rules list actions for app failed
Api - app rules list actions for app success
Api - app rules list condition operators for app failed
Api - app rules list condition operators for app success
Api - app rules list conditions for app failed
Api - app rules list conditions for app success
Api - app rules list for app failed
Api - app rules list for app success
Api - app rules refresh entitlements for app failed
Api - app rules refresh entitlements for app success
Api - app rules sort for app failed
Api - app rules sort for app success
Api - app rules update for app failed
Api - app rules update for app success
App app removed from role
App was added by user
App was removed by user
App was updated by user

Users

Account granted permission to privilege_name
Account revoked permission to privilege_name
Actor_user assumed user
Actor_user changed password for user
Actor_user deleted secure note id: note_id
Actor_user disabled task_name
Actor_user disabled terms and conditions for policy
Actor_user edited secure note id: note_id
Actor_user enabled task_name
Actor_user enabled terms and conditions for policy
Actor_user failed to change password for user
Actor_user failed to import csv
Actor_user generated temporary otp token for user
Actor_user initiated offboarding for user
Actor_user initiated onboarding for user
Actor_user marked task_name complete for user
Actor_user marked task_name complete for user
Actor_user redirected to an external site for password reset
Actor_user removed profile picture for user
Actor_user revealed password to app for user
Actor_user revoked device certificate
Actor_user revoked temporary otp token for user
Actor_user revoked user certificate
Actor_user unlocked user
Actor_user unlocked user in directory
Actor_user updated credit card
Actor_user updated terms and conditions for policy
Actor_user uploaded profile picture for user
Actor_user viewed secure note id: note_id
Admin actor_user changed password for user
App configuration error
App throttled
Credit card update failed
Directory sync directory_sync_run_id
Downloaded browser cert
Entitlement action
Failed to import user from directory
Nameid was successfully proxied to app via idp trusted_idp.
No users to import
One of directory's connectors was disabled
One of directory's connectors was enabled
Otp_device deregistered for user
Otp_device registered for user
Ous were updated for directory
Password request approved from user
Provisioning deprovisioning mode do nothing warning
Refresh schema action failed
Self registration approved for user
Self registration denied for user
Self registration request for user
Smart password could not be updated for user
Smart password updated for user
Task_name for user was completed by actor_user
Task_name for user was completed by actor_user
Task_name for user was marked incomplete by actor_user
Unmatched users
User added phone number
User added to role
User added to role failed
User agreed to terms and conditions
User authenticated by radius_config
User authenticated via api
User authentication policy does not allow sign-in via social network: notes
User automatically added to role
User automatically removed from role
User could not be created
User could not be determined by radius_config
User could not be updated
User deactivated by actor_user
User deleted device for onelogin desktop
User denied access to app
User did not agree to terms and conditions
User disabled offboarding
User disabled onboarding
User enabled offboarding
User enabled onboarding
User failed authentication
User failed authentication via api
User failed authentication with vldap, notes
User failed to authenticate via onelogin desktop
User failed to log in on a trusted device
User failed to log into app
User failed to login via onelogin desktop
User granted access to app
User granted permission to manage role
User granted permission to manage role failed
User granted permission to privilege_name
User is not authorized to access app app
User limit reached
User locked
User logged into app
User logged into onelogin
User logged out of onelogin
User not updated in app
User permission to manage role revoked
User permission to manage role revoked failed
User permission to privilege_name revoked
User reactivated
User rejected by radius_config
User removed from role
User removed from role failed
User requested access to app
User requested new password
User signed in into onelogin via social network: notes
User successfully authenticated with vldap
User successfully logged in on a trusted device
User successfully logged in via onelogin desktop
User successfully verified authenticator otp_device
User suspended by actor_user
User unbind user from device for onelogin desktop
User updated by actor_user
User updated phone number
User was activated by actor_user
User was created by actor_user
User was created by tidp trusted_idp
User was deleted by actor_user
User was force logged out
User was imported

OneLogin

A mapping was skipped for user; notes
Account approaching seat limit
Account at seat limit
Actor_user added license to user
Actor_user added mapping_name mapping
Actor_user added user_field_name custom user field
Actor_user attempted to update login information
Actor_user bulk licensed users
Actor_user created broadcaster
Actor_user created group group
Actor_user created privilege privilege_name
Actor_user created secure note id: note_id
Actor_user created self registration
Actor_user deleted broadcaster
Actor_user deleted mapping_name mapping
Actor_user deleted privilege privilege_name
Actor_user deleted self registration
Actor_user deleted user_field_name custom user fields
Actor_user destroyed group group
Actor_user disabled mapping_name mapping
Actor_user enabled mapping_name mapping
Actor_user failed to license user
Actor_user failed to reapply mappings for user
Actor_user is not authorized to perform privilege_actionon_app
Actor_user is not authorized to perform privilege_actionon_user
Actor_user manually updated user login for app
Actor_user reapplied mappings for user
Actor_user removed license from user
Actor_user retried provisioning
Actor_user tried to manually add user to app.
Actor_user unlocked user via api
Actor_user updated broadcaster
Actor_user updated group group
Actor_user updated mapping_name mapping
Actor_user updated privilege privilege_name
Actor_user updated self registration
Actor_user updated user login information
Admin actor_user changed account settings for object
Admin actor_user created payment record for object
Admin actor_user deleted payment record for object
Admin actor_user updated payment record for object
Api - authorization app created
Api - authorization app creation failed
Api - authorization app destroy failed
Api - authorization app destroyed
Api - authorization app update failed
Api - authorization app updated
Api - authorization claim created
Api - authorization claim destroy failed
Api - authorization claim destroyed
Api - authorization claim failed
Api - authorization claim update failed
Api - authorization client created
Api - authorization client creation failed
Api - authorization client destroy failed
Api - authorization client destroyed
Api - authorization client update failed
Api - authorization client updated
Api - authorization scope created
Api - authorization scope creation failed
Api - authorization scope destroy failed
Api - authorization scope destroyed
Api - authorization scope update failed
Api - authorization scope updated
Api - authorization token call failed using client_name
Api - authorization token called using client_name
Api - bad request using client_name
Api - confirm otp for user using client_name failed
Api - confirm otp for user using client_name succeeded
Api - custom attributes set for user using client_name
Api - failed to set custom attribute
Api - get otps for user using client_name
Api - get resource / attributes on resource using client_name
Api - invite link not obtained using client_name
Api - invite link not sent using client_name
Api - invite link sent using client_name
Api - invite link using client_name
Api - one record returned on resource using client_name
Api - otp created for user using client_name
Api - page of results returned on resource using client_name
Api - password not updated for user using client_name
Api - password not updated for user using client_name
Api - password updated for user using client_name
Api - password updated for user using client_name
Api - privilege privilege_name assigned to role using api_credential_name
Api - privilege privilege_name removed from role using api_credential_name
Api - privilege privilege_name removed from user user using api_credential_name
Api - privilege privilege_name was assigned to user user using api_credential_name
Api - privilege privilege_name was created using api_credential_name
Api - privilege privilege_name was deleted using api_credential_name
Api - privilege privilege_name was updated using api_credential_name
Api - roles added to user using client_name
Api - roles get for failed
Api - roles get for success
Api - roles list administrators for failed
Api - roles list administrators for success
Api - roles list apps for failed
Api - roles list apps for success
Api - roles list failed
Api - roles list success
Api - roles list users for failed
Api - roles list users for success
Api - roles not added to user using client_name
Api - roles not removed for user using client_name
Api - roles removed for user using client_name
Api - roles update for failed
Api - roles update for success
Api - trigger factor for user using client_name succeeded
Api - unauthorized using client_name
Api - user created using client_name
Api - user deleted using client_name
Api - user failed to log out using client_name
Api - user locked using client_name
Api - user logged out using client_name
Api - user not created using client_name
Api - user not deleted using client_name
Api - user not locked using client_name
Api - user not updated using client_name
Api - user updated using client_name
Api - verify factor called using client_name
Api - verify factor failed using client_name
App app added to role
App app added to role failed
App app failed to create via api
App app failed to destroy via api
App app failed to update via api
App app removed from role failed
App app was created via api
App app was destroyed via api
App app was updated via api
App has reached user limit
Assigned to user user
Brand created via api
Brand destroyed via api
Brand failed to create via api
Brand failed to destroy via api
Brand failed to update via api
Brand updated via api
Bulk operation failed for user user
Bulk operation triggered
Certificate_name is about to expire
Connector object could not be created
Connector object could not be deleted
Connector object could not be updated
Connector object was created by user
Connector object was deleted by user
Connector object was updated by user
Connector stats updated
Delete user failed
Directory attributes import failed for directory
Directory attributes import from directory finished
Directory attributes import from directory started
Directory caught an exception
Directory caught an exception
Directory connector provisioning error in directory
Directory external id was deleted for user
Directory external id was updated for user
Directory failed over
Directory failed over
Directory field(s) is not unique
Directory import limit reached
Directory in use
Directory reloaded configuration
Directory reloaded configuration
Directory started
Directory started
Directory stopped
Directory stopped
Entitlements cache action
Export from directory finished
Export from directory started
External assume user
External groups import from directory finished
External groups import from directory started
Failed to create sandbox by user
Failed to create sandbox using api_credential_name
Failed to delete sandbox by user
Failed to delete sandbox using api_credential_name
Failed to provision user to directory
Failed to reapply entitlement mappings for user in app app
Failed to reapply mappings for user
Failed to remove user user from app app
Failed to sync sandbox by user
Failed to update sandbox by user
Failed to update sandbox using api_credential_name
Import from directory finished
Import from directory started
Import user failed
Job already scheduled
Job failed to start
Job terminated
Ldap directory directory caught an exception
Nameid failed to login to app via idp trusted_idp.
Notification from directory
Notification from directory
Nt hash requested for user
Object - notification was sent to user
Oidc authorization code for app failed
Oidc authorization code for app success
Oidc client credentials for app failed
Oidc client credentials for app success
Oidc general fail
Oidc get code for app failed
Oidc get code for app success
Oidc implicit flow for app failed
Oidc implicit flow for app success
Oidc password for app failed
Oidc password for app success
Oidc refresh token for app failed
Oidc refresh token for app success
Oidc revoke token for app failed
Oidc revoke token for app success
Oidc user info for app failed
Oidc user info for app success
Oidc validate token for app failed
Oidc validate token for app success
Otp_device unlocked for user
Parameter object could not be created
Parameter object could not be deleted
Parameter object could not be updated
Parameter object was created by user
Parameter object was deleted by user
Parameter object was updated by user
Provisioning event
Reapplied entitlement mappings for user in app app
Report report_name cloned by actor_user
Report report_name created by actor_user
Report report_name destroyed by actor_user
Report report_name failed generation in background
Report report_name terminated during generation in background
Report report_name updated by actor_user
Report report_name was generated in background
Role (role_id) created by user (user_id)
Role (role_id) deleted by user (user_id)
Role created failed
Role deleted failed
Saml assertion warning for actor_user note
Sandbox created using api_credential_name
Sandbox deleted by user
Sandbox deleted using api_credential_name
Sandbox sync initiated by user
Sandbox updated by user
Sandbox updated using api_credential_name
Scriptlet error: nameid
Self registration request submitted for user
Self registration request verified for user
Sending email with custom smtp settings failed
Smart hook created
Smart hook creation failed
Smart hook deleted
Smart hook deletion failed
Smart hook environment variable created
Smart hook environment variable creation failed
Smart hook environment variable deleted
Smart hook environment variable deletion failed
Smart hook environment variable retrieved
Smart hook environment variable update failed
Smart hook environment variable updated
Smart hook environment variables retrieved
Smart hook execution failed
Smart hook execution was successful
Smart hook fetched
Smart hook logs retrieved
Smart hook update failed
Smart hook updated
Smart hooks retrieved
Sms failure
Smtp configuration updated
Successfully reapplied mappings for user
Sync sandbox by user completed
User actor_user assigned the privilege privilege_name to role
User actor_user assigned the privilege privilege_name to user user
User actor_user is not authorized to perform privilege_action on policy
User actor_user is not authorized to perform privilege_actionon_group
User actor_user is not authorized to perform privilege_actionon_report
User actor_user is not authorized to perform privilege_actionon_role
User actor_user is not authorized to perform privilege_actionon_trusted_idp
User actor_user removed the privilege privilege_name from role
User actor_user removed the privilege privilege_name from user user
User added connector instance to directory directory
User added directory directory
User associated to directory
User challenged for otp
User changed default portal/profile language
User changed new login detection setting
User changed password through profile
User changed phone number
User changed portal default tab through profile
User changed tabs setting
User created a sandbox linked to object
User created api_credential_name api credential
User created authentication factor authentication_factor
User created certificate_name certificate
User created policy policy
User created proxy agent proxy_agent
User created radius attribute in radius_config
User created radius configuration radius_config
User deleted api_credential_name api credential
User deleted authentication factor authentication_factor
User deleted certificate_name certificate
User deleted connector instance from directory directory
User deleted directory directory
User deleted in directory
User deleted policy policy
User deleted proxy agent proxy_agent
User deleted radius attribute in radius_config
User deleted radius configuration radius_config
User deleted security factor
User denied auth via otp push request
User disabled adaptive login for account
User disabled api_credential_name api credential
User disabled branding
User disabled desktop sso
User disabled embedding
User disabled virtual ldap
User disabled vpn
User disassociated from directory
User enabled adaptive login for account
User enabled api_credential_name api credential
User enabled branding
User enabled desktop sso
User enabled embedding
User enabled virtual ldap
User enabled vpn
User failed authentication with vldap (onelogin desktop mac), notes
User failed otp challenge
User failed remote authentication
User failed to provision in directory
User has added trusted_idp to trusted idps
User has been provisioned to directory successfully
User has changed the default trusted idp to trusted_idp
User has modified the trusted idp trusted_idp
User has removed trusted_idp as default trusted idp
User has removed trusted_idp from trusted idps
User imported from directory
User invited by actor_user
User locked via api
User logged out of app
User provisioned in directory
User reactivated in directory
User reactivated via api
User reauthenticated into app
User recently removed
User rejected
User renamed security factor
User set new default factor
User successfully authenticated with vldap (onelogin desktop mac), notes
User suspended by actor_user via api
User suspended in directory
User unset default factor
User updated account settings
User updated authentication factor authentication_factor
User updated branding
User updated by directory
User updated company info
User updated desktop sso settings
User updated directory directory
User updated embedding settings
User updated policy policy
User updated profile photo
User updated radius attribute in radius_config
User updated radius configuration radius_config
User updated security questions
User updated virtual ldap settings
User updated vpn settings
User-synch active directory connector not responding
Users in unlicensed state
Workday real-time notification

Provisioning

Could not authenticate to app
Provisioning exception
User could not be deleted in app
User could not be provisioned in app
User could not be reactivated in app
User could not be suspended in app
User could not be updated in app
User deleted in app
User linked in app
User provisioned in app
User reactivated in app
User suspended in app
User updated in app

Expand/Collapse Comments
:     
Was this helpful?
YesYesNoNo