r6e40 (r6e40) asked a question.
Hi I am looking for a report that lists applications granted to users and data showing application removed from a user within a certain time frame. The only close report for application granted data I found was in Okta > Reports > Entitlements and Access > User App Access, although this only shows active users data, is there a way to show history of application membership granted for deactivated accounts?
For applications removed from a user data I found this report in Okta > Reports > Application Access Audit > Recent Unassignments , which shows data for application removal for deactivated accounts and active ones. Any other ones reports I could be looking at for seeing reports on application unassignment data?
@r6e40 (r6e40) - If a report that obtains the subset of data that you need doesn't exist you would likely need to build your own. This can be done by making API calls to the System Logs endpoints which would house 90 days of activity. You can then filter the events down to the 2 eventTypes you are concerned with:
eventType eq "application.user_membership.add" or eventType eq "application.user_membership.remove"
Process the returned results pulling the data you are concerned with and storing it somewhere. If done with lets say Okta Workflows you could potentially use a Workflows table (100k max rows). If you are programming a script/app yourself same idea.. just output it as like a CSV and you have your report.
Thanks for the response Tim, I have saved eventType eq "application.user_membership.add" or eventType eq "application.user_membership.remove custom search filter as a report and will be using it going forward. I also added a search filter parameter to look for a certain user with data points mentioned above: (eventType eq "application.user_membership.add" or eventType eq "application.user_membership.remove") and target.alternateId eq "users email.com"
Question on the 90 days of activity, do you know why it can only go back 90 days, any explanation/resources explaining this?