Searching the Okta System Log for Group to Individual Application Assignment Conversion

An administrator can search the Okta System Log for events where a group assignment on an application changes to an individual assignment. After running the query, the administrator can identify the relevant assignment conversion events.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta System Log
• System Log Queries

The application.user_membership.update event also records other application changes, so a search for that event alone returns results beyond group-to-individual assignment conversions. The debugContext.debugData.requestUri value identifies the API request pattern for the assignment change and narrows the results to the relevant events.

How is the Okta System Log searched for group to individual application assignment conversion events?

Enter the eventType and debugContext.debugData.requestUri query to filter the relevant System Log events.

eventType eq "application.user_membership.update" and debugContext.debugData.requestUri sw "/api/v1/apps/"

• The first part of the query searches for user membership updates as an event.
• This event also appears for other changes made to the application.
• When an assignment changes, the request URI for the API call uses the format /api/v1/apps/<group ID>/users/<user ID>.
• The group ID and user ID change with each change, so the query includes part of the API endpoint in the System Log search.
• The sw operator means starts with.
• The API query starts with "/api/v1/apps/" and includes other unique operators when the change from group to individual assignment occurs.