Deprovision Details report

The Deprovision Details report queries the System Log for data about the applications a user has been deprovisioned from and how the deprovision was initiated over a specified period of time.

The default query eventType eq "application.provision.user.deprovision" shows all deprovision events.

You can use filters to show results by username, display name, application name, and others. See Common filters.

Prerequisites

  • This report can be run by anyone with one of the following permission levels:

    • Super admin

    • Org admin

    • Read-Only admin

    • Mobile admin

    • Report admin

Parameters

The report can be filtered using any of the following parameters:

  • Start date and start time

  • End date and end time

  • Timezone

  • Any Okta Expression Language search

Procedure

  1. In the Admin Console, go to ReportsReports.

  2. Click Deprovision Details.

  3. Specify a date range to filter the report. Okta retains events for 90 days, so the earliest available date range is 3 months prior.

  4. Specify a search filter. Click Advanced Filters to construct more complex filters.

  5. Click the search icon to generate the report.

  6. If you want a detailed comma-separated file (CSV) file of the report, click Download CSV.

  7. Click the expand arrow icon to open the details for each event returned.

  8. Click any of the actor, event info, or target results to create a more specific filter.

    • If you modify a search filter, you can click Save beside the search icon to store a record of this specific filter. After you give this new report a name, it's added to the Reports page, above the System log panel.

  9. Click the blue geolocation icon to see a map showing where in the world the event occurred (based on IP geolocation). Click the grid icon to return to the original report UI.

Results

The generated report contains the following fields:

Field name Field description

Time

Timestamp of the event

Actor

App integration or user that caused the event or action

Event Information

Details about the event or action

Target

App integration or user that received the event or action

Common filters

Filter Query

Filter by user login (username)

 eventType eq "application.provision.user.deprovision" AND target.alternateId eq "someuser@foo.bar"

Filter by user display name

 eventType eq "application.provision.user.deprovision" and target.displayName eq "some name"

Filter by application instance name

 eventType eq "application.provision.user.deprovision" AND (target.alternateId eq "Application name" or target.displayName eq "Application Name")

Filter by application id

 eventType eq "application.provision.user.deprovision" and target.id eq "0oaSomeValue"

Filter by application username

eventType eq "application.provision.user.deprovision" AND target.alternateId eq "someuser@foo.bar"

Filter by resolution: auto deprovisioned

eventType eq "application.provision.user.deprovision" and target.detailEntry.resolution eq "Auto Deprovisioned"

Filter by resolution: manually deprovisioned

eventType eq "application.provision.user.deprovision" and target.detailEntry.resolution eq "Manually Deprovisioned"

Filter by user and application

eventType eq "application.provision.user.deprovision" and target.alternateId eq "someuser@foo.bar" and target.displayName eq "Application Name"