This article provides steps for searching the system log for events in which an administrator has converted a group assignment on an application to an individual assignment.

• Okta System Log 
• System Log Queries

The following system log entry will filter for events where an administrator converted a user from a group assignment to an individual assignment for an app. 

eventType eq "application.user_membership.update" and debugContext.debugData.requestUri sw "/api/v1/apps/"

• The first part of the query searches for user membership updates as an event.
  • However, this event is also logged for other changes that are made to the app.
• When an assignment is changed, the request URI for the API call that is made would be in the format /api/v1/apps/<group ID>/users/<user ID>.
• Since the group ID and user ID change with each change, we have to add a portion of the API endpoint to the system log query.
• Since it is a partial search, we use the operator “SW”, which means starts with.
• So the API query starts with "/api/v1/apps/" and would contain other unique operators when the change from group to individual assignment is made.