altv8 (altv8) asked a question.
Looking to get a better understanding of Okta access requests, particularly around their event logs.
Okta access request documentation: https://help.okta.com/oie/en-us/content/topics/identity-governance/access-requests/ar-overview.htm
Per API event types documentation, I see there are events for a few actions, such as creation of an access request, rejection, expiration. All these events appear to be under names like access.request.* . I’m not seeing an event name in this list for the act of approving an access request - does approving an access request trigger an event that gets logged by Okta? If so, what’s the event name?
Secondly, is there any way to correlate an access request to the temporary addition to a group that supplies the new permissions to the user per the request? I'm aware there are logs for group membership additions, but I’m wondering if there’s any identifiable piece of data from the log event generated from the access request that can be used to correlate with the group membership addition log event.
API events documentation: https://developer.okta.com/docs/reference/api/event-types/
Thanks in advance!
Hi @altv8 (altv8) , Thank you for reaching out to the Okta Community!
While I admit this is not my area of expertise, I ran this by my OIG colleagues and got the following information for you:
I’m not seeing an event name in this list for the act of approving an access request - does approving an access request trigger an event that gets logged by Okta? If so, what’s the event name?
No event for this currently. Possible implementation in the future, but no ETA yet.
Secondly, is there any way to correlate an access request to the temporary addition to a group that supplies the new permissions to the user per the request? I'm aware there are logs for group membership additions, but I’m wondering if there’s any identifiable piece of data from the log event generated from the access request that can be used to correlate with the group membership addition log event.
Also no event for this one, the closest thing would be to use the public API to fetch more info about the request using the request ID in the Okta System logs event.
I also recommend checking in with the OIG Discussion group for anything OIG related.
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--
Ask Us Anything thru 9/3 Okta’s New MFA Requirement for Admin Console Access