-
Bug
-
Resolution: Duplicate
-
Low
-
None
-
2
-
Minor
-
Issue Summary
Audit logs do not capture events for two scenarios:
- Email address or Full name change of a user directly via managed accounts is not captured in Audit logs.
- IDP synced user removed from the group at IDP deactivates the account. The user's group removal is logged in the audit log but the user's deactivation event is not logged.
Steps to Reproduce
- Change the email address or full name of the user under the managed account for a user and check audit logs.
- For scenario 2: remove an IDP synced user from all IDP synced groups, this will deactivate the user, deactivated account event is not logged in audit logs through the user's group membership removal is logged.
Expected Results
The above-explained scenarios should be captured in audit logs.
Actual Results
Events for the explained scenarios are not captured in audit logs.
Workaround
Currently, there is no known workaround for this behavior. A workaround will be added here when available
- duplicates
-
ACCESS-1129 Add audit log when IDP synced user is removed from group in idp
- Gathering Interest
-
- Gathering Interest
- is related to
-
- Gathering Interest
[ACCESS-1195] Events not captured in Audit logs - user changes and IDP user removal
The first section of this request - adding changes made to Managed user to the audit log is already tracked in ACCESS-1129 – Add user profile and account changes to org audit log - when changes are made to a Managed user
With that in mind, I propose we change the title of this issue to "Add IDP user removal to org-level audit logs". Can the watchers of this issue let me know if they see any problems with making this change? Thank you!
After some analysis, we've found that this ticket is a duplicate of two other requests which have more votes:
We encourage you to watch and vote on the above instead. All internal ticket references on this ticket have been transferred. If you do not think this issue should have been closed, please add a comment here saying why and we can reopen it as needed.