sdf8j (sdf8j) asked a question.
Can I run a report to show the IP address a user authenticated from?
I need to see where and when users authenticate via mfa.
- oxptp (oxptp)
You can do this using the System Log GUI or the System Log API to get this information. If you are doing this in the GUI you can use the search filter 'eventType eq "user.authentication.auth_via_mfa"'. You can then choose the option to 'Download CSV', view the items in the standard layout, or click the map marker to view a graphical layout of locations. If you're searching for just a specific user you can use the filter 'actor.id eq "USER_ID" and eventType eq "user.authentication.auth_via_mfa"'
If you're trying to create a more customized report you can also do this via the API. You can find more information about the System Log API here: https://developer.okta.com/docs/reference/api/system-log/
Expand Post
This question is closed.
You can do this using the System Log GUI or the System Log API to get this information. If you are doing this in the GUI you can use the search filter 'eventType eq "user.authentication.auth_via_mfa"'. You can then choose the option to 'Download CSV', view the items in the standard layout, or click the map marker to view a graphical layout of locations. If you're searching for just a specific user you can use the filter 'actor.id eq "USER_ID" and eventType eq "user.authentication.auth_via_mfa"'
If you're trying to create a more customized report you can also do this via the API. You can find more information about the System Log API here: https://developer.okta.com/docs/reference/api/system-log/