This article explains how to generate a report containing users who were deleted, suspended, and/or deactivated in the last three months, which is the maximum amount of time that the System Log will hold information in Okta.

• System Log
• Reports

1. Please navigate to the Okta Admin Dashboard and go to Reports > System Logs.
2. Please set the time frame (and timezone) to search for. The maximum one can go is 3 months from the current date.
3. In the search field, use one of the following System Log queries:
   • eventType eq "user.lifecycle.delete.completed" - For deleted users
   • eventType eq "user.lifecycle.deactivate" - For deactivated users
   • eventType eq "user.lifecycle.suspend" - For suspended users
   • To generate a report containing all suspended, deactivated, and deleted users in Okta, it is possible to chain all 3 queries with an "or" between them.

4. Export the logs by clicking the Downloading CSV button, and manipulate the file to suit the organization's operational needs.

Related References

• Event Types
• Search System Logs
• System Log filters and search