How to determine if someone has changed sensitive data (for example, an immutableID, email address, etc.).

• Okta System logs
• Microsoft Office 365 (O365) Integration
• Attributes

Build 2023.11.1 (released into production 5 Dec 2023) added additional tracking to the user-updated Syslog events to track changes to attributes. With the inclusion of this additional data, monitoring for changes to sensitive attributes becomes possible, enabling the flagging of such changes and facilitating further analysis.

 
 
In the screenshot above, see the addition of ChangedAttributes to the syslog event for a user where we changed their firstName, displayName, and testAttr. 

Run a syslog query like the one below to return entries where the user has had their attributes updated:
debugContext.debugData.ChangedAttributes co  <attribute>

For example:
debugContext.debugData.ChangedAttributes co  "firstName"