Okta Group

eventType	Description	Sample	Rule
group.application_assignment.add	Add assigned application to group.	Y	N
group.application_assignment.remove	Remove assigned application from group.	Y	N
group.application_assignment.skip_assignment_reconcile		N	N
group.application_assignment.update	Update assigned application in group.	N	N
group.lifecycle.create	Create Okta group.	Y	N
group.lifecycle.delete	Delete Okta group.	Y	N
group.privilege.grant	Group's admin privilege granted.	Y	Y
group.privilege.revoke	Group's admin privilege revoked.	Y	N
group.profile.update	Okta group profile updated.	Y	N
group.user_membership.add	Add user to group membership.	Y	N
group.user_membership.remove	Remove user from group membership.	Y	N
group.user_membership.rule.add_exclusion	Add user to group membership exclusion rule.	N	N
group.user_membership.rule.deactivated		N	N
group.user_membership.rule.error	group membership rule is in error state.	N	N
group.user_membership.rule.evaluation		N	N
group.user_membership.rule.invalidate	Invalidate group membership rule.	N	N
group.user_membership.rule.trigger	Trigger group membership rule.	Y	N

group.application_assignment.add

Description

Add assigned application to group.

Example System Log Event #

{
  "actor": {
    "id": "00u00000000000000002",
    "type": "User",
    "alternateId": "user02@dw-harness.example",
    "displayName": "DW Harness 02",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "198.51.100.2",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000010",
    "externalSessionId": "0000000000000000000000010"
  },
  "displayMessage": "Add assigned application to group",
  "eventType": "group.application_assignment.add",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-24T03:38:42.504Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000000000000018",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
      "groupAppAssignmentId": "gaa00000000000000020",
      "requestUri": "/api/v1/apps/0oa00000000000000013/groups/00g00000000000000019",
      "url": "/api/v1/apps/0oa00000000000000013/groups/00g00000000000000019?"
    }
  },
  "gatewayContext": null,
  "legacyEventType": "group.application_assignment.add",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000018",
    "detail": {
      "rootApiTokenId": "00T00000000000000004",
      "requestApiTokenId": "00T00000000000000004"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000025",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "198.51.100.2",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00g00000000000000019",
      "type": "UserGroup",
      "alternateId": "user03@dw-harness.example",
      "displayName": "DW Harness 07",
      "detailEntry": null
    },
    {
      "id": "0oa00000000000000013",
      "type": "AppInstance",
      "alternateId": "user05@dw-harness.example",
      "displayName": "DW Harness 06",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: group.application_assignment.add

group.application_assignment.remove

Description

Remove assigned application from group.

Example System Log Event #

{
  "actor": {
    "id": "00u00000000000000002",
    "type": "User",
    "alternateId": "user02@dw-harness.example",
    "displayName": "DW Harness 02",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "198.51.100.2",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "trs00000000000000021",
    "externalSessionId": "trs00000000000000021"
  },
  "displayMessage": "Remove assigned application from group",
  "eventType": "group.application_assignment.remove",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-24T03:38:42.613Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000000000000019",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
      "groupAppAssignmentId": "gaa00000000000000020",
      "requestUri": "/api/v1/apps/0oa00000000000000013/groups/00g00000000000000019",
      "url": "/api/v1/apps/0oa00000000000000013/groups/00g00000000000000019?"
    }
  },
  "gatewayContext": null,
  "legacyEventType": "group.application_assignment.remove",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000019",
    "detail": {
      "rootApiTokenId": "00T00000000000000004",
      "requestApiTokenId": "00T00000000000000004"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000026",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "198.51.100.2",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00g00000000000000019",
      "type": "UserGroup",
      "alternateId": "user03@dw-harness.example",
      "displayName": "DW Harness 07",
      "detailEntry": null
    },
    {
      "id": "0oa00000000000000013",
      "type": "AppInstance",
      "alternateId": "user05@dw-harness.example",
      "displayName": "DW Harness 06",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: group.application_assignment.remove

group.application_assignment.skip_assignment_reconcile

References #

Okta Event Types Catalog: group.application_assignment.skip_assignment_reconcile

group.application_assignment.update

Description

Update assigned application in group.

References #

Okta Event Types Catalog: group.application_assignment.update

group.lifecycle.create

Description

Create Okta group. This can be used to make sure an Okta group is successfully created. Event fired when an Okta group is successfully created.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000030",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Create okta group",
  "eventType": "group.lifecycle.create",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:35:48.950Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/groups",
      "url": "/api/v1/groups?"
    }
  },
  "legacyEventType": "group.lifecycle.create",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "UserGroup",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: group.lifecycle.create

group.lifecycle.delete

Description

Delete Okta group. This can be used to make sure an Okta group is successfully deleted. Event fired when an Okta group is successfully deleted.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000031",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Delete okta group",
  "eventType": "group.lifecycle.delete",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:35:49.830Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/groups/00g00000000000000008",
      "url": "/api/v1/groups/00g00000000000000008?"
    }
  },
  "legacyEventType": "group.lifecycle.delete",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "UserGroup",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: group.lifecycle.delete

group.privilege.grant

Description

Group's admin privilege granted. This can be used to audit the provisioning of admin privileges for groups. When fired, this event contains information about the type of admin privileges the group currently has, and what entity sources the group. The group granted privileges can be an Okta sourced group, and AD-sourced group, or an LDAP-sourced group Related events include: GROUP_PRIVILEGE_REVOKE.

Example System Log Event #

{
  "actor": {
    "id": "00u00000000000000002",
    "type": "User",
    "alternateId": "user02@dw-harness.example",
    "displayName": "DW Harness 02",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "198.51.100.2",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000004",
    "externalSessionId": "0000000000000000000000004"
  },
  "displayMessage": "Grant group privilege",
  "eventType": "group.privilege.grant",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-24T03:47:36.080Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000000000000007",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
      "privilegeGranted": "Read only admin",
      "requestUri": "/api/v1/groups/00g00000000000000007/roles",
      "url": "/api/v1/groups/00g00000000000000007/roles?"
    }
  },
  "gatewayContext": null,
  "legacyEventType": "core.group.admin_privilege.granted",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000007",
    "detail": {
      "rootApiTokenId": "00T00000000000000004",
      "requestApiTokenId": "00T00000000000000004"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000008",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "198.51.100.2",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00g00000000000000007",
      "type": "UserGroup",
      "alternateId": "user03@dw-harness.example",
      "displayName": "DW Harness 04",
      "detailEntry": null
    }
  ]
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`eventType`	eq	`group.privilege.grant`	2 rules	panther, sigma
`eventType`	eq	`user.account.privilege.grant`	2 rules	panther, sigma
`okta::eventType` (kusto rule field)	in	`policy.evaluate_sign_on`	1 rule	kusto
`okta::eventType` (kusto rule field)	in	`system.api_token.create`	1 rule	kusto
`okta::eventType` (kusto rule field)	in	`user.session.start`	1 rule	kusto
`p_occurs_between` (panther rule field)	macro	`'2022-01-14' , '2022-03-22'`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Okta Admin Role Assigned to an User or Group source medium: Detects when an the Administrator role is assigned to an user or group.T1098, T1098.003

Elastic #

Administrator Privileges Assigned to an Okta Group source medium: Detects when an administrator role is assigned to an Okta group. An adversary may attempt to assign administrator privileges to an Okta group in order to assign additional permissions to compromised user accounts and maintain access to their target organization.T1098, T1098.003
Okta User Assigned Administrator Role source medium: Identifies when an administrator role is assigned to an Okta user or group. Adversaries may assign administrator privileges to compromised accounts to establish persistence, escalate privileges, and maintain long-term access to the environment. This detection monitors for both user-level and group-level administrator privilege grants, which can be used to bypass security controls and perform unauthorized administrative actions.T1098, T1098.003

Kusto #

High-Risk Admin Activity source medium: The Okta risk engine auto-assigns risk levels to each login attempt. This rule identifies successful admin operations that correlate with successful high-risk Okta authentication or session start events.T1078, T1078.004, T1098

Panther #

Okta Group Admin Role Assigned source high: Detect when an admin role is assigned to a group
Okta Admin Access Granted source: Audit instances of admin access granted in your okta tenant

References #

Okta Event Types Catalog: group.privilege.grant

group.privilege.revoke

Description

Group's admin privilege revoked. This can be used to audit the deprovisioning of admin privileges from groups. When fired, this event indicates the group has no more admin privileges. All of group's privileges were revoked. Related events include: GROUP_PRIVILEGE_GRANT.

Example System Log Event #

{
  "actor": {
    "id": "00u00000000000000002",
    "type": "User",
    "alternateId": "user02@dw-harness.example",
    "displayName": "DW Harness 02",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "198.51.100.2",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "trs00000000000000009",
    "externalSessionId": "trs00000000000000009"
  },
  "displayMessage": "Revoke group privilege",
  "eventType": "group.privilege.revoke",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-24T03:47:36.226Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "privilegeRevoked": "Super administrator, Organization administrator, Application administrator (all), Application administrator, Read only admin, User administrator (all), User administrator, Help Desk administrator (all), Help Desk administrator, Mobile administrator, API Access Management administrator, Report administrator, Group Membership administrator",
      "requestId": "00000000000000000000000000000008",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
      "requestUri": "/api/v1/groups/00g00000000000000007/roles/gra00000000000000010",
      "url": "/api/v1/groups/00g00000000000000007/roles/gra00000000000000010?"
    }
  },
  "gatewayContext": null,
  "legacyEventType": "core.group.admin_privilege.revoked",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000008",
    "detail": {
      "rootApiTokenId": "00T00000000000000004",
      "requestApiTokenId": "00T00000000000000004"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000009",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "198.51.100.2",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00g00000000000000007",
      "type": "UserGroup",
      "alternateId": "user03@dw-harness.example",
      "displayName": "DW Harness 04",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: group.privilege.revoke

group.profile.update

Description

Okta group profile updated. Events of this type can be used by an IT administrator who wants to trigger an Okta Workflow to provision groups into downstream systems. The utility of the Event type is for Provisioning use cases to downstream systems.A classic example of this is a customer who uses Okta for Office 365 LCM, and wants to push a distribution list from Okta to Office 365.

Example System Log Event #

{
  "actor": {
    "id": "00u00000000000000002",
    "type": "User",
    "alternateId": "user02@dw-harness.example",
    "displayName": "DW Harness 02",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "198.51.100.2",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000005",
    "externalSessionId": "0000000000000000000000005"
  },
  "displayMessage": "Group Profile Update",
  "eventType": "group.profile.update",
  "outcome": {
    "result": "SUCCESS",
    "reason": "Group Profile Update Succeeded"
  },
  "published": "2026-07-24T03:38:39.117Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000000000000007",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
      "requestUri": "/api/v1/groups/00g00000000000000006",
      "changedAttributes": "name,description",
      "url": "/api/v1/groups/00g00000000000000006?"
    }
  },
  "gatewayContext": null,
  "legacyEventType": null,
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000007",
    "detail": {
      "rootApiTokenId": "00T00000000000000004",
      "requestApiTokenId": "00T00000000000000004"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000008",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "198.51.100.2",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00g00000000000000006",
      "type": "UserGroup",
      "alternateId": "user03@dw-harness.example",
      "displayName": "DW Harness 04",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: group.profile.update

group.user_membership.add

Description

Add user to group membership.

Example System Log Event #

{
  "actor": {
    "id": "00u00000000000000002",
    "type": "User",
    "alternateId": "user02@dw-harness.example",
    "displayName": "DW Harness 02",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "198.51.100.2",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000008",
    "externalSessionId": "0000000000000000000000008"
  },
  "displayMessage": "Add user to group membership",
  "eventType": "group.user_membership.add",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-25T23:23:50.026Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000000000000020",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
      "requestUri": "/api/v1/groups/00g00000000000000027/users/00u00000000000000030",
      "url": "/api/v1/groups/00g00000000000000027/users/00u00000000000000030?"
    }
  },
  "gatewayContext": null,
  "legacyEventType": "core.user_group_member.user_add",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000020",
    "detail": {
      "rootApiTokenId": "00T00000000000000004",
      "requestApiTokenId": "00T00000000000000004"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000027",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "198.51.100.2",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00u00000000000000030",
      "type": "User",
      "alternateId": "user08@dw-harness.example",
      "displayName": "DW Harness 11",
      "detailEntry": null
    },
    {
      "id": "00g00000000000000027",
      "type": "UserGroup",
      "alternateId": "user03@dw-harness.example",
      "displayName": "DW Harness 10",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: group.user_membership.add

group.user_membership.remove

Description

Remove user from group membership.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000036",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Remove user from group membership",
  "eventType": "group.user_membership.remove",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:35:49.380Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/groups/00g00000000000000008/users/00u00000000000000011",
      "url": "/api/v1/groups/00g00000000000000008/users/00u00000000000000011?"
    }
  },
  "legacyEventType": "core.user_group_member.user_remove",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "User",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    },
    {
      "id": "00000000000000000000",
      "type": "UserGroup",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: group.user_membership.remove

group.user_membership.rule.add_exclusion

Description

Add user to group membership exclusion rule.

References #

Okta Event Types Catalog: group.user_membership.rule.add_exclusion

group.user_membership.rule.deactivated

References #

Okta Event Types Catalog: group.user_membership.rule.deactivated

group.user_membership.rule.error

Description

group membership rule is in error state.

References #

Okta Event Types Catalog: group.user_membership.rule.error

group.user_membership.rule.evaluation

References #

Okta Event Types Catalog: group.user_membership.rule.evaluation

group.user_membership.rule.invalidate

Description

Invalidate group membership rule.

References #

Okta Event Types Catalog: group.user_membership.rule.invalidate

group.user_membership.rule.trigger

Description

Trigger group membership rule.

Example System Log Event #

{
  "published": 1783215343030,
  "id": null,
  "etag": null,
  "kind": null,
  "uuid": "00000000-0000-0000-0000-000000000071",
  "actor": {
    "id": "00u00000000000000153",
    "type": "User",
    "alternateId": "user08@dw-harness.example",
    "displayName": "DW Harness 10",
    "detailEntry": {
      "realmId": "guo00000000000000062"
    }
  },
  "client": {
    "userAgent": null,
    "zone": null,
    "device": null,
    "id": null,
    "ipAddress": null,
    "geographicalContext": null
  },
  "device": null,
  "events": null,
  "target": [
    {
      "id": "0pr00000000000000257",
      "type": "PolicyRule",
      "alternateId": "user59@dw-harness.example",
      "displayName": "DW Harness 83",
      "detailEntry": null
    },
    {
      "id": "00g00000000000000258",
      "type": "UserGroup",
      "alternateId": "user06@dw-harness.example",
      "displayName": "DW Harness 84",
      "detailEntry": null
    }
  ],
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "request": {
    "ipChain": []
  },
  "version": "0",
  "severity": "INFO",
  "eventType": "group.user_membership.rule.trigger",
  "ipAddress": null,
  "networkInfo": null,
  "transaction": {
    "type": "JOB",
    "id": "eru00000000000000259",
    "detail": {}
  },
  "debugContext": {
    "debugData": {}
  },
  "displayMessage": "Group membership rule triggered",
  "gatewayContext": null,
  "legacyEventType": null,
  "resourceDetails": null,
  "securityContext": {
    "asNumber": null,
    "asOrg": null,
    "isp": null,
    "domain": null,
    "isProxy": null
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "10200000000000000260",
    "externalSessionId": "trs00000000000000261"
  }
}