This article provides administrators with instructions for monitoring and querying abandoned Multi-Factor Authentication (MFA) attempts using the Okta System Log API. This can be useful for creating custom reports to identify users who do not complete the MFA process.

• Okta System Log API
• Custom Reports
• Okta Identity Engine (OIE)
• Multi-Factor Authentication (MFA)

To identify users who have abandoned the MFA authentication process, query the Okta System Log. The logs will show an "ABANDONED" result for the user.authentication.auth_via_mfa event type.

Use the following API query to filter for these specific events: {{baseUrl}}/api/v1/logs?filter=eventType eq "user.authentication.auth_via_mfa" and (outcome.result eq "ABANDONED").

Event for system log: eventType eq "user.authentication.auth_via_mfa" and (outcome.result eq "ABANDONED").

This query retrieves a list of all MFA attempts that the end-user did not successfully complete. This data can then be used to build custom reports for monitoring and administrative purposes.