<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
Actions Taken by Okta Workflows are Attributed to a User Account in the System Log
Workflows
Overview
When reviewing the Okta System Log, the API actions performed by Okta Workflows show a user account as the Actor field. This article clarified why these actions are attributed to a user account and not Workflows.
Applies To
  • Okta Workflows
  • Okta System Logs
Cause
Okta Workflows is authorized using OAuth 2.0 Authorization Code flow. The token issued at the time of authorization is issued to the user account that is logged in when granting consent on the OAuth consent screen, and subsequent actions taken using that token will be logged under that same account.
Solution

The actions being attributed to a user account are not strictly a problem, as this complies with OAuth design. However, there are some considerations involved. If the user account used to authorize the Workflows connection is Suspended, Deactivated, Deleted, or has its active sessions cleared, Workflows invoking Okta API functions will cease to function as expected with either 401 Unauthorized or 403 Forbidden return codes, depending on the scenario.

In many cases, it is a better practice to create a specific Super Admin service account for Okta Workflows and authorize the connection with that account. This will attribute any actions taken to a descriptively named account and help to avoid scenarios where the account is Suspended, Deactivated, Deleted, or has its active sessions cleared mistakenly.
 

Related References

Loading
Actions Taken by Okta Workflows are Attributed to a User Account in the System Log