# Authentication audit

1. [Home](https://www.agilicus.com/)
2. [Agilicus AnyX Administrative Web Interface](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/)
3. [Organisation](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/)
4. Authentication audit

![](https://www.agilicus.com/www/f227a439-featured-anyx-admin-organisationauthentication-audit.png)## Authentication audit

[CONTACT](/contact-us/)

The **Authentication Audit** page (route `/authentication-audit`) is a searchable record of sign-in activity across your whole organisation: who has signed in, from where, when, and whether it succeeded.

![Authentication audit overview](https://www.agilicus.com/www/b8d076ef-authentication-audit-overview.png)    ## Purpose

Authentication audit records capture identity events at the organisation level, including sign-in attempts, multi-factor authentication challenges, and assertion requests between the portal and your identity providers. This screen lets you search those records by time range, limit the number of results, page through the table, expand any event to see its details, and download the results.

Authentication events are one part of the audit picture described in [Audit and diagnostics](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/audit-and-diagnostics/).

## Why use it

- Answer the question *who signed in, when, from where, and did it succeed?*
- Investigate a user's sign-in failures, including multi-factor authentication failures.
- Confirm that a user reached the platform before you diagnose an access problem (see [Diagnosing user issues with audits](https://www.agilicus.com/diagnosing-user-issues-with-audits)).
- Correlate sign-in activity with a source IP address or a client application.
- Export the audit results for compliance or further analysis.

## When to use it

- During troubleshooting of a sign-in or access issue.
- When auditing a specific user's activity (combine with [Sessions](/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/sessions/) and [user audits](/anyx-guide/agilicus-anyx-administrative-web-interface/access/audits/)).
- As part of a compliance review of authentication events.

**Prerequisite**: read permission for authentication audits (an owner or administrator role). The page shows a *no permissions* message otherwise.

## How to use it

1. Open **Organisation > Authentication Audit** from the left navigation.
2. Choose a **time frame** from the list: Custom, Last 5 mins, Last 15 mins, Last 30 mins, Last hour, Last 6 hours, Last 12 hours, or Last 36 hours. The default is **Last hour**.

![Time frame options](https://www.agilicus.com/www/3e2f8e7f-authentication-audit-timeframe-menu.png)    1. If you chose **Custom**, pick the **start date** and **end date** with the date pickers.
2. Set **Max number of results** to the upper bound you want (for example 100).
3. Select **VIEW AUDITS** to load the records into the table.
4. Page through the results, or expand a row to see its details.
5. Select **DOWNLOAD AUDITS** to export the current results as `auth-audit-data.csv`.

![Custom date range](https://www.agilicus.com/www/0caa82da-authentication-audit-custom-range.png)    ### Reading the table

Each row shows the timestamp, email, event, result, client identifier, and source IP. Events include authentication requests and assertion requests between the identity provider and the connector.

![Results with totals](https://www.agilicus.com/www/1276fa52-authentication-audit-results.png)    Expanding a row shows the full detail for that event, including token identifier, trace identifier, upstream identity provider, the device or browser used, and the application name.

![Expanded row detail](https://www.agilicus.com/www/3e2f8e7f-authentication-audit-row-expanded.png)    ## Fields and controls reference

| Field or control | Purpose | Required | Default | Valid values | Notes |
|---|---|---|---|---|---|
| Time frame | The window of events to search | Yes | Last hour | Custom; last 5, 15, 30 minutes; last 1, 6, 12, 36 hours | Custom reveals the start and end date pickers |
| Choose start date | Start of a custom window | Yes (custom) | None | A date and time | The end date cannot be before it |
| Choose end date | End of a custom window | Yes (custom) | None | A date and time | The start date cannot be after it |
| Max number of results | Upper bound on returned records | Yes | None | A number |  |
| VIEW AUDITS | Loads the records for the chosen window | n/a | n/a | n/a |  |
| DOWNLOAD AUDITS | Exports the current results as CSV | n/a | n/a | n/a | Produces `auth-audit-data.csv` |

### Table columns

| Column | Meaning |
|---|---|
| Timestamp | When the event happened |
| Email | The identity that acted |
| Event | The kind of event (for example Authentication Request or Assertion Request) |
| Result | Success, failure, or in-progress |
| Client Id | The client application that initiated the event (for example `admin-portal` or an agent connector) |
| Source IP | The IP address the request came from |

Expanded rows add: Token id, Trace id, Upstream idp, Device/Browser Used, and Application Name.

## Dialogs and popups

There are no configuration dialogs on this screen. It is a search and review interface.

## Configuration versus diagnostics versus confirmation

- **Configuration**: none. This screen does not change authentication settings; it only reads them.
- **Diagnostics**: the entire screen is diagnostic: searchable authentication events with expandable detail and CSV export.
- **Confirmation**: none. There are no destructive actions.

## Pagination and async behaviour

- The table pages at **25 rows per page**. The paginator shows the total (for example *1 - 25 of 35*); select **Next** or a page number to move through the results.

![Page two of results](https://www.agilicus.com/www/2529a78f-authentication-audit-page2.png)    - Results load asynchronously: after selecting **VIEW AUDITS**, wait a moment for the table to populate. Use the paginator to fetch further pages.

## Troubleshooting

- **The table is empty**: widen the time frame or raise the max results. The default window is the last hour.
- **A user shows a failed result**: use the trace identifier in the expanded row to correlate with the audit subsystem, and check the user's multi-factor authentication status (see [Reset multi-factor token](https://www.agilicus.com/reset-multi-factor-token-code-for-a-user)).
- **The download is empty**: run **VIEW AUDITS** first; the export reflects the currently loaded results.
- **Events from agents dominate the view**: filter by time and inspect the Client Id column to distinguish portal sign-ins from connector or agent activity.

## See also

- [Audit and diagnostics](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/audit-and-diagnostics/)
- [Audit subsystem](/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/audit-subsystem/)
- [Sessions](/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/sessions/)
- [Identity and authentication](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/identity-and-authentication/)
- [Getting started: audit a user](/anyx-guide/agilicus-anyx-administrative-web-interface/getting-started/audit-user/)

## Web guide

- [Authentication audit](https://www.agilicus.com/product-guide/authentication-audit)
- [Diagnosing user issues with audits](https://www.agilicus.com/diagnosing-user-issues-with-audits)
- [Zero trust audit logging](https://www.agilicus.com/zero-trust-audit)