Administrators can trace changes to an end user's profile by querying specific event types in the Okta System Log. Querying the System Log allows administrators to identify the exact actor who modified a user profile.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• System Log
• User Profile

How are user profile changes traced in the Okta System Log?

Use specific Event Types in the Okta System Log to find information about user profile changes. Review the following event types that track profile updates.

• directory.app_user_profile.update: Update application user profile.
• system.agent.ldap.update_user: Fired when Lightweight Directory Access Protocol (LDAP) Delegated Authentication is used to sign in and a user profile is updated. Administrators can use this to identify user profile changes resulting from corresponding changes in the LDAP directory. The previous name for this event was system.agent.ad.update_user.
• user.account.update_profile: Update user profile for Okta.
• user.account.update_user_type: Fires when a user changes from one type to another. Administrators can use this to audit when a user converts from a contractor to a full-time employee. Data includes the old and new type IDs. An accompanying update_profile event may exist if values have changed.

Enter the following query in the search bar when searching the System Log.

eventType eq "directory.app_user_profile.update" or eventType eq "system.agent.ldap.update_user" or eventType eq "user.account.update_profile" or eventType eq "user.account.update_user_type"

If required, download the Comma-Separated Values (CSV) file or select Expand All to view the details of each event.

Related References

• Event Types