How do I find out who created an account and when? Skip to main content
https://support.okta.com/help/answers?id=9060z00000078fnqay&refurl=http%3a%2f%2fsupport.okta.com%2fhelp%2fanswers
How satisfied are you with the Okta Help Center?
Thank you for your feedback!
How satisfied are you with the Okta Help Center?
1
2
3
4
5
Very Dissatisfied
Very satisfied
Enter content less than 200 characters.
Ask Search:
Rion EdwardsRion Edwards 

How do I find out who created an account and when?

It seems the history in our Okta instance is limited and I'm setup as a full Super Admin.  We don't have a rouge account that was created through a mobile app, but we do have an admin account that is showing up on our notfiications.  I can confirm the account is setup as an admin, but we need to find out who created it and when.  There doesn't seem to be any audit section that we can find.
Cristian MondiruCristian Mondiru (Okta, Inc.)
Hello Rion,

  
 Thank you for reaching out to Okta Support!
 User creation can be tracked in System Logs by using eventType eq "user.lifecycle.create" as search criteria. If you are also interested in checking when the account was set to have admin permissions, eventType eq "user.account.privilege.grant" can be used in order to identify the timestamp for the change in question.

 If you encounter any difficulties in locating the events in the available System Log data, please do not hesitate to open a support ticket and we will further assist.  



Thank you,

Cristian Mondiru
Technical Support Engineer