Workplace security logs
Workplace security logs keep a record of all security events. Below is a list of all the events we currently record, alongside a short explanation of what they mean.
|A user has successfully logged in using either password or SSO.
|A user has unsuccessfully tried to log in.
|A user has logged out.
|An admin has forced a user to log out via the admin panel.
|A user has changed their Workplace password.
|Password Reset Succeeded
|A user has reset their Workplace password by setting a new password.
|Password Reset Code Requested
|A user's Workplace password has been requested for reset through the self-service flow.
|Password Reset Incorrect Code
|The verification code required to reset a user's Workplace password has been entered incorrectly.
|Forced Password Reset
|An admin has forced a user's password to be reset before next login.
|Two-Factor Authentication Enabled
|A user has self-enrolled in two-factor authentication. Learn more on how this is enabled.
|Two-Factor Authentication Disabled
|Two-factor authentication has been disabled by a user.
|Two-Factor Code Entry Succeeded
|A user has successfully entered their two-factor authentication code when prompted on desktop or mobile.
|Two-Factor Code Entry Failed
|A user has unsuccessfully entered their two-factor authentication code when prompted on desktop or mobile.
|Two-Factor Code Entry Succeeded On Mobile App
|A user has successfully entered their two-factor authentication code when prompted on the Android or iOS app.
|Two-Factor Code Entry Failed On Mobile App
|A user has unsuccessfully entered their two-factor authentication code when prompted on the Android or iOS app.
|An admin requested SSO (Single Sign-On) Reauthentication from their users.
|Account at Risk
|There's a user whose account is at risk. Learn more about how to identify accounts at risk.
|Account Set To Unclaimed
|An admin or integration has set a user to unclaimed.
|Profile Automaticatically Deleted
|A user account has been deleted automatically after being unclaimed for 27 days or longer.
|A user has been deactivated by an admin or an integration.
|A user has been activated by an admin or an integration.
|A user account has been deleted.
|A user account has been created by an admin.
|An admin has created user accounts with the Excel import method.
|Account Promoted to Admin
|An existing user has been promoted to admin.
|Created users via IDP Sync
|Users have been created by a connected identity provider (Azure or G Suite).
|Self Invite Created
|A user created their account using self-invite.
|A user has been invited to Workplace.
|Created Users via Coworker Invite
|Users have been created through invites from other community members.
|A user has been invited through an invite from another community member. The user account is only created after they accept the invite.
|A user's email address has been updated.
|Phone Number Added
|A user has added a phone number to their account.
|Profile Data Download Requested
|A user has put in a request to download their profile data.
|Profile Data Downloaded
|A user has downloaded their profile data.
|Admin Role Changed
|An admin account's role has been updated.
|A user's admin role has been removed.
|A user account has been created through the Administrators section and has been promoted to an admin role.
|A domain has been added to the verification table, but it has not been verified yet.
|A domain has been verified successfully. Learn more about domain verification.
|A domain has been removed from Workplace.
|Group File Downloaded
|A file has been downloaded from a group.
|Group File Uploaded
|A file has been uploaded to a group. Learn how to upload a file to a group.
|Malware Suspected in File
|A file is suspected of having malware and has been blocked from being uploaded to a group.
|Malware Upload Blocked
|Malware found in a file upload was blocked.
|Compromised Credentials Found
|An account was found to have compromised credentials for username or password authentication.
|A custom integration has been created.
|A custom integration has been edited.
|A custom integration has been deleted.
|An app from the integration directory has been added.
|A integration directory app has been removed.
|Integration Access Token Reset
|An integration access token was reset.
|Multi-Company Group Created
|A multi-company group has been created.
|Joined Multi-Company Group
|A user has joined a multi-company group.
|Report Former Employee
|Persisted events from former employee reports.
|A user has reported a post for the admin to review.
|Enabled insights tab for non-admin user.
|Disabled insights tab for non-admin user.
|Reseller Invite Sent
|A company has been invited to be linked.
|Reseller Invite Accepted
|Invited company to be linked has accepted the invite.
|Reseller Invite Declined
|Invited company to be linked has declined the invite.
|A user has downloaded a video.