When an Admin role is revoked, the following is shown in the Okta system log when searching using the following query:

eventType eq "user.account.privilege.revoke"

 

Expanding one of the events, the PrivilegeRevoked field is seen populated with the following roles:

• Super administrator
• Organization administrator
• Application administrator (all)
• Application administrator
• Read-only admin
• User administrator (all)
• User administrator
• Help Desk administrator (all)
• Help Desk administrator
• Mobile administrator
• API Access Management administrator
• Report administrator
• Group Membership administrator

The goal of this article is to explain the contents of the PrivilegeRevoked field.

• System Log
• Remove an admin role assignment

When no other roles remain assigned for a user, it is expected behavior to see all the Standard Admin roles in the PrivilegeRevoked field.

The Administrator Roles that are listed in the PrivilegeRevoked section do not represent the actual privileges that the user account had before revocation.

• This is a general message that is logged for every user.account.privilege.revoke event, regardless of the actual administrator roles that were revoked. 
• When no roles remain assigned for a user, the events will include all the roles and display them by default.
• If any admin roles remain after revoking a user's admin role, the actual role(s) will be displayed.

Related References

• Use standard roles
• Event Types