Read Only Impersonation Access System Logs Audit Events
Feb 19, 2026
Okta Identity Engine
Administration
Overview
Okta provides a transparent audit trail for all instances where Okta Support is granted access to the customer environment. Impersonation cannot occur without explicit approval from a Super Admin.
Applies To
- Read Only Impersonation Access
- Okta Identity Engine (OIE)
Solution
There are five specific event types used to track the lifecycle of support access, from the initial grant through session termination.
Event Types and Descriptions
| Event Type | Description |
user.session.impersonation.grant | Recorded when a Super Admin grants Okta Support access to the org. Use this to see who approved access and when. |
user.session.impersonation.revoke | Recorded when a Super Admin manually revokes support access before the original expiration time. |
user.session.impersonation.extend | Recorded when a Super Admin extends the duration of the currently active support access. |
user.session.impersonation.initiate | Recorded the moment an Okta Support Engineer actually signs into the org using the granted permission. |
user.session.impersonation.end | Recorded when the Support Engineer signs out, or the impersonation session expires/ends. |
These logs ensure a full audit trail and guarantee that Okta Support access is always authorized by internal admins. By monitoring these five events, security teams can verify exactly who granted access, when the support session occurred, and when it concluded.
How to Search the Logs
The steps below can be followed to audit these actions:
- Log in to the Okta Admin Console.
- Navigate to Reports > System Log.
- In the search bar, enter the desired query using the
eventTypesyntax.- Example:
eventType eq "user.session.impersonation.initiate".
- Example:
- Adjust the time range as needed and click the Search (magnifying glass) icon.
- Expand the log entry to view detailed information, including the actor and the timestamp.
Audit and Retention
- Default Retention: All impersonation events are retained in the Okta System Log for 90 days.
- Long-term Storage: If compliance requirements exceed 90 days, it is recommended to export these logs via the Okta API or stream them to a Security Information and Event Management (SIEM) system (for example, Splunk, Sumo Logic, or Datadog).
