How do I find out who created an account and when?
It seems the history in our Okta instance is limited and I'm setup as a full Super Admin. We don't have a rouge account that was created through a mobile app, but we do have an admin account that is showing up on our notfiications. I can confirm the account is setup as an admin, but we need to find out who created it and when. There doesn't seem to be any audit section that we can find.
Thank you for reaching out to Okta Support! User creation can be tracked in System Logs by using eventType eq "user.lifecycle.create" as search criteria. If you are also interested in checking when the account was set to have admin permissions, eventType eq "user.account.privilege.grant" can be used in order to identify the timestamp for the change in question.
If you encounter any difficulties in locating the events in the available System Log data, please do not hesitate to open a support ticket and we will further assist.