Differentiating IdP-Initiated and SP-Initiated Logins in Okta Reports
Last Updated:
Overview
Administrators can gather data on user application logins and differentiate between Identity Provider (IdP)-initiated and Service Provider (SP)-initiated logins by using the Application Access report. An IdP-initiated login occurs when the user clicks the application tile from the dashboard. An SP-initiated login occurs when the user authenticates directly from the application's login page. After filtering the System Log query and exporting the results, administrators can identify each login type.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Reports
- Application Access report
- System Log
Solution
How are IdP-initiated and SP-initiated logins differentiated in the Application Access report?
Use Reports, Application access, the System Log query, and Download CSV to differentiate login types and export the results.
- Navigate to the Okta Admin Console.
- Go to Reports > Reports.
- Under the System log panel on the right side of the screen, select Application access. This action opens the System Log page with a pre-populated query that shows all application logins.
- Specify a date range to filter the report. NOTE: System log events are retained for 90 days.
-
Enter the following query to filter all IdP-initiated login events:
eventType eq "user.authentication.sso" and debugContext.debugData.initiationType eq "IDP_INITIATED" -
Enter the following query to filter all SP-initiated login events:
eventType eq "user.authentication.sso" and debugContext.debugData.initiationType eq "SP_INITIATED" -
Select Download CSV to export the filtered results.
