Authentication audit

The Authentication Audit page (route /authentication-audit) is a searchable record of sign-in activity across your whole organisation: who has signed in, from where, when, and whether it succeeded.

Purpose

Authentication audit records capture identity events at the organisation level, including sign-in attempts, multi-factor authentication challenges, and assertion requests between the portal and your identity providers. This screen lets you search those records by time range, limit the number of results, page through the table, expand any event to see its details, and download the results.

Authentication events are one part of the audit picture described in Audit and diagnostics.

Why use it

Answer the question who signed in, when, from where, and did it succeed?
Investigate a user’s sign-in failures, including multi-factor authentication failures.
Confirm that a user reached the platform before you diagnose an access problem (see Diagnosing user issues with audits).
Correlate sign-in activity with a source IP address or a client application.
Export the audit results for compliance or further analysis.

When to use it

During troubleshooting of a sign-in or access issue.
When auditing a specific user’s activity (combine with Sessions and user audits).
As part of a compliance review of authentication events.

Prerequisite: read permission for authentication audits (an owner or administrator role). The page shows a no permissions message otherwise.

How to use it

Open Organisation > Authentication Audit from the left navigation.
Choose a time frame from the list: Custom, Last 5 mins, Last 15 mins, Last 30 mins, Last hour, Last 6 hours, Last 12 hours, or Last 36 hours. The default is Last hour.

If you chose Custom, pick the start date and end date with the date pickers.
Set Max number of results to the upper bound you want (for example 100).
Select VIEW AUDITS to load the records into the table.
Page through the results, or expand a row to see its details.
Select DOWNLOAD AUDITS to export the current results as auth-audit-data.csv.

Reading the table

Each row shows the timestamp, email, event, result, client identifier, and source IP. Events include authentication requests and assertion requests between the identity provider and the connector.

Expanding a row shows the full detail for that event, including token identifier, trace identifier, upstream identity provider, the device or browser used, and the application name.

Fields and controls reference

Field or control	Purpose	Required	Default	Valid values	Notes
Time frame	The window of events to search	Yes	Last hour	Custom; last 5, 15, 30 minutes; last 1, 6, 12, 36 hours	Custom reveals the start and end date pickers
Choose start date	Start of a custom window	Yes (custom)	None	A date and time	The end date cannot be before it
Choose end date	End of a custom window	Yes (custom)	None	A date and time	The start date cannot be after it
Max number of results	Upper bound on returned records	Yes	None	A number
VIEW AUDITS	Loads the records for the chosen window	n/a	n/a	n/a
DOWNLOAD AUDITS	Exports the current results as CSV	n/a	n/a	n/a	Produces `auth-audit-data.csv`

Table columns

Column	Meaning
Timestamp	When the event happened
Email	The identity that acted
Event	The kind of event (for example Authentication Request or Assertion Request)
Result	Success, failure, or in-progress
Client Id	The client application that initiated the event (for example `admin-portal` or an agent connector)
Source IP	The IP address the request came from

Expanded rows add: Token id, Trace id, Upstream idp, Device/Browser Used, and Application Name.

Dialogs and popups

There are no configuration dialogs on this screen. It is a search and review interface.

Configuration versus diagnostics versus confirmation

Configuration: none. This screen does not change authentication settings; it only reads them.
Diagnostics: the entire screen is diagnostic: searchable authentication events with expandable detail and CSV export.
Confirmation: none. There are no destructive actions.

Pagination and async behaviour

The table pages at 25 rows per page. The paginator shows the total (for example 1 – 25 of 35); select Next or a page number to move through the results.

Results load asynchronously: after selecting VIEW AUDITS, wait a moment for the table to populate. Use the paginator to fetch further pages.

Troubleshooting

The table is empty: widen the time frame or raise the max results. The default window is the last hour.
A user shows a failed result: use the trace identifier in the expanded row to correlate with the audit subsystem, and check the user’s multi-factor authentication status (see Reset multi-factor token).
The download is empty: run VIEW AUDITS first; the export reflects the currently loaded results.
Events from agents dominate the view: filter by time and inspect the Client Id column to distinguish portal sign-ins from connector or agent activity.