Checking audit logs for provisioning

You can check the audit logs for provisioning when using federated login for Google Workspace.

Checking user activity logs

About this task: You can list all user events in provisioning in descending chronological order, where items with status Failure are highlighted in red. You can also click on the individual events and see their details.

Log in and access the Admin Console at https://admin.lastpass.com/.
Go to Users > Directories.
Select the Google Workspace tab.
Click View integration logs.
Click the User activity tab.
Optional: Search for a specific identity.

Alternatively, you can also filter log events based on whether they failed or were successful by using the state filter.
Click on a specific integration log to see the log's details.

Checking system activity logs

About this task: You can list all system events related to provisioning in descending chronological order, where items with status Failure are highlighted in red. You can also click individual events and view their details. Checking logs can be useful when looking for the root cause of an issue. It is good practice for Admins to check system logs and share log details with the Support team when requesting help with troubleshooting.

Log in and access the Admin Console at https://admin.lastpass.com/.
Go to Users > Directories.
Select the Google Workspace tab.
Click View integration logs.
Click the System activity tab.
You can filter log events based on whether they failed or were successful by using the state filter.

For each event in the list, the following information is displayed:
- Date: Date and time of event
- Event: Event type (currently, all events are related to provisioning)
- State: State of event, that is, whether the event represents a success or a failure
Click an entry in the event list to view further details.
The following information is displayed:
- Date: Date and time of event in the following format:
  - Date: MM/DD/YYYY (for example: 08/19/2022)
  - Time: h:mm with am or pm appended (for example: 6:06pm)
    The time zone is UTC.
- Event: Event type (currently, all events are related to provisioning)
- State: State of the event, that is, whether the event represents a successful event, or a failed event
- Fail reason: This is the reason for the failure (when applicable). If the event is not a failure, no information is provided in this field.
  When the failure is due to a configuration-related error, a message is displayed that should help an Admin fix the configuration error.
  
  When the failure is due to some internal system error, an ErrorId is displayed. In such cases, the Support team can help investigate and fix the issue.