This article details how to find a password reset event or a temporary password being generated by an administrator.

• System Logs

The system logs can be queried for past events to create a query depending on the use case. 

1. The following system log query is for a temporary password that is generated for a user on the Admin Console:
   • eventType eq "user.account.update_password"
2. The following system log query is for a password reset event in which an email is sent to the end user after selecting the option in the Admin Console.
   • eventType eq "user.account.reset_password"
3. Self Service Password reset events can be seen in the logs if the Actor performing the action is "Okta System (SystemPrincipal)".
   • eventType eq "user.account.reset_password"
4. If the Actor field lists an administrator account, then the reset was performed by the Administrator on the Admin Console. 

Related References

• User Sign-in and Recovery Events in the Okta System Log
• Event Types