What are Workplace security logs?

Workplace security logs keep a record of all security events. Below is a list of all the events we currently record, alongside a short explanation of what they mean.
Event NameNote
Logged inA user has successfully logged in using either password or SSO.
Login FailedA user has unsuccessfully tried to log in.
Logged outA user has logged out.
Forced LogoutAn admin has forced a user to log out via the admin panel.
Password ChangedA user has changed their Workplace password.
Password Reset SucceededA user has reset their Workplace password by setting a new password.
Password Reset Code RequestedA user's Workplace password has been requested for reset through the self-service flow.
Password Reset Incorrect CodeThe verification code required to reset a user's Workplace password has been entered incorrectly.
Forced Password ResetAn admin has forced a user's password to be reset before next login.
Two-Factor Authentication EnabledA user has self-enrolled in two-factor authentication. Learn more on how this is enabled.
Two-Factor Authentication DisabledTwo-factor authentication has been disabled by a user.
Two-Factor Code Entry SucceededA user has successfully entered their two-factor authentication code when prompted on desktop or mobile.
Two-Factor Code Entry FailedA user has unsuccessfully entered their two-factor authentication code when prompted on desktop or mobile.
Two-Factor Code Entry Succeeded On Mobile AppA user has successfully entered their two-factor authentication code when prompted on the Android or iOS app.
Two-Factor Code Entry Failed On Mobile AppA user has unsuccessfully entered their two-factor authentication code when prompted on the Android or iOS app.
SSO Reauthentication An admin requested SSO (Single Sign-On) Reauthentication from their users.
Account at RiskThere's a user whose account is at risk. Learn more about how to identify accounts at risk.
Account Set To UnclaimedAn admin or integration has set a user to unclaimed.
Profile Automaticatically DeletedA user account has been deleted automatically after being unclaimed for 27 days or longer.
Account DeactivatedA user has been deactivated by an admin or an integration.
Account ActivatedA user has been activated by an admin or an integration.
Account DeletedA user account has been deleted.
Account CreatedA user account has been created by an admin.
Accounts CreatedAn admin has created user accounts with the Excel import method.
Account Promoted to AdminAn existing user has been promoted to admin.
Created users via IDP SyncUsers have been created by a connected identity provider (Azure or G Suite).
Self Invite Created A user created their account using self-invite.
User Invited A user has been invited to Workplace.
Created Users via Coworker InviteUsers have been created through invites from other community members.
Invited CoworkerA user has been invited through an invite from another community member. The user account is only created after they accept the invite.
Email ChangedA user's email address has been updated.
Phone Number AddedA user has added a phone number to their account.
Profile Data Download Requested A user has put in a request to download their profile data.
Profile Data Downloaded A user has downloaded their profile data.
Admin Role ChangedAn admin account's role has been updated.
Admin RemovedA user's admin role has been removed.
Admin CreatedA user account has been created through the Administrators section and has been promoted to an admin role.
Domain AddedA domain has been added to the verification table, but it has not been verified yet.
Domain VerifiedA domain has been verified successfully. Learn more about domain verification.
Domain RemovedA domain has been removed from Workplace.
Group File DownloadedA file has been downloaded from a group.
Group File UploadedA file has been uploaded to a group. Learn how to upload a file to a group.
Malware Suspected in FileA file is suspected of having malware and has been blocked from being uploaded to a group.
Malware Upload Blocked Malware found in a file upload was blocked.
Compromised Credentials FoundAn account was found to have compromised credentials for username or password authentication.
Integration CreatedA custom integration has been created.
Integration EditedA custom integration has been edited.
Integration DeletedA custom integration has been deleted.
Integration AddedAn app from the integration directory has been added.
Integration RemovedA integration directory app has been removed.
Integration Access Token Reset An integration access token was reset.
Multi-Company Group CreatedA multi-company group has been created.
Joined Multi-Company GroupA user has joined a multi-company group.
Company Marked as Resold
Report Former Employee Persisted events from former employee reports.
Reported Content A user has reported a post for the admin to review.
Reseller AddedEnabled insights tab for non-admin user.
Reseller Removed Disabled insights tab for non-admin user.
Reseller Invite Sent A company has been invited to be linked.
Reseller Invite Accepted Invited company to be linked has accepted the invite.
Reseller Invite Declined Invited company to be linked has declined the invite.
Video DownloadedA user has downloaded a video.
Was this information helpful?