Filter Okta System Log for Administrator Role Assignment Events
Last Updated:
Overview
Okta logs an event in the System Log whenever it assigns or revokes an administrator role for a user. Filter the System Log using specific event types to view these administrator role assignments and revocations.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- System Log
- Administrators
Solution
How does an administrator filter role assignments and revocations in the System Log?
Enter the specific event type queries into the System Log search field to view administrator role assignments and revocations.
- View all administrator role assignments:
eventType eq "user.account.privilege.grant" - View all administrator role revocations:
eventType eq "user.account.privilege.revoke"
Okta Enforces Specific Data Retention and Export Policies
Review the data retention policies and export the data to an external system to retain it for longer than 90 days.
NOTE: Okta automatically purges data in accordance with the Workforce Identity Cloud Customer Data Retention Policy.
- Service Backup Data: Okta takes complete database snapshots hourly and automatically purges them after six months.
- System Log: Okta automatically removes application-generated system data and reporting based on log data older than 90 days.
Download the data from the System Log user interface or the API, or export it to an external event management system, such as a Security Information and Event Management (SIEM) tool, to retain data for longer than 90 days.
