System Log Query to See All the MFA Factor Reset Events
Nov 7, 2025
Okta Classic Engine
Multi-Factor Authentication
Okta Identity Engine
Overview
This article provides a System Log query for admins to find all the Multi-Factor Authentication (MFA) Factor Reset events.
Applies To
- Multi-Factor Authentication (MFA)
- System Log
- MFA Factor Reset Events
Solution
Leverage the following query to find all the MFA Factor Reset events in the System Logs:
eventType eq "user.mfa.factor.deactivate"
Related References
- See User Sign-in and Recovery Events in the Okta System Log for more System Log queries.
