User Activity

This report you can customise to show the information that you are interested in the format is below:

The Report includes:

• Event – This outlines what the user did, either Authentication (Logging in for the first time), Authorisation (Logging into a service) or Authentication Failed (Bad username and/or Password)
• IP Address – The IP that the user logged in from.
• Date and Time

You can filter this search with the following options:

• From and To: These are the date fields that allow you to choose a date range for your events to show for. Clicking on the brings up a calendar to allow you to pick a date and choose a time. You can also adjust the values in the box directly.
• For User: This will narrow the search down to a single user. As you begin to type it will show you options that match what you are currently typing.
• For SSO Service: This is a dropdown which will allow you to choose the Service that you are interested in.
• For Event: Allows you to choose what the user did, either Authentication (Logging in for the first time), Authorisation (Logging into a service) or Authentication Failed (Bad username and/or Password)

Downloaded User Activity Report

You can also download the reports that are generated on your school's cloudwork dashboard by clicking download. An email will be sent to the user. Go to the email sent from reports and follow the link in the email. This link will lead you back to the dashboard where you can click the hyperlink and get the report in the form of a CSV file.

The Reports that come from User Activity contain:

• Date: Time and date of when activity occurred
• Name: Username
• IP Address: IP address of user
• Service: What SSO Service did the user Sign in to
• Event: What the user did in Cloudwork dashboard or Cloudwork ID

List of Events

• 2FA Disabled: This event occurs when 2FA has been disabled for a user
• 2FA Verification: This event occurs when 2FA is being used to login
• Add App Second Factor: This event occurs when an Authentication App is enabled for a user
• Add Mobile Second Factor: This event occurs when SMS is enabled for a user
• Authentication: This event occurs when a user logs into the system
• Authentication Failed: This event occurs when a user failed to log into the system
• Authorization:
• Authorize Failed:
• Enable 2FA: This event occurs when 2FA has been enabled for a user
• Invalid Reset Code: This event occurs when after initiating password reset, you input the incorrect recovery code
• Lockout Activated: This event occurs when a user has attempted to login too many times
• Password Change: This event occurs when a user has had their password changed
• Password Reset Started: This event occurs when a user has forgotten their password and has requested for a password change
• Password Reset Complete: This event occurs after a user has inputted a recovery code and changed their password
• Remove App Second Factor: This event occurs when a user remove 2FA via App from their account
• Remove Mobile Second Factor: This event occurs when a user remove 2FA via SMS from their account
• Update Password Recovery Details: This event occurs when a updates their recovery information
• Username Recovery: This event occurs when a user initiates username recovery