Training Investigate Login Activity

Training: Investigate Login Activity

What you'll learn: how to use the Authentication Event Log to answer "why can't they log in?" and "who accessed what?" You need: Administrator access type, enterprise admin application. Time: 4 minutes.

Steps

1. Go to Left menu → Access Control → Authentication Event Log. (Fallback: search "Authentication" in the header.)
2. The date range defaults to today — widen Start Date if you're investigating something older.
3. Filter for your question and click the orange search button:
   • User can't log in: set Username + Authentication Event Status = Failure, read the Failure Reason.
   • Who accessed an application today: set Tenant.
   • Is an API key in use: set User Api Key and widen the dates.
4. Read the rows: Created At, Event Type, Status, Username, Tenant, Role.

Normal noise: paired "VerifyTokenExpired / Failure" + "TokenRefresh / Success" entries are routine session renewals — not break-in attempts.

5. If the user is rate-limited from failed attempts: go to Access Control → Enterprise Users → open the user → click unlock.

Check your work

After an unlock, the user can sign in immediately — confirm with a new Success row in the log.

Related training

Training: Configure the Internal Password Policy · Training: Create an API Key