> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/admin-portal/monitoring-and-reporting.md). # Monitoring & Reporting *** ## Overview All reports live under the **Reports** icon in the left menu. Log in to AdminX as a tenant/community administrator or help desk admin to get started. Key reports export to `.csv` for easy sharing. ### Which report do I need? | Report | Use it to… | | ------------------------- | --------------------------------------------------------------------------------------- | | **Last Login** | See each user's most recent login and spot accounts inactive for 30, 60, or 90+ days | | **Login Activity** | Drill into authentication and login activity by user, MFA method, app, and date | | **Event Logs** | Investigate specific tenant events across users, authentication, IDV, and admin actions | | **Access Denied** | Review logins blocked by your IP and Geolocation rules | | **Admin Activity** | Audit what other admins did, to whom, and when | | **Admin Role Assignment** | See who holds privileged roles | | **Report Downloads** | Export Event Logs and Login Activity reports to CSV and grab completed files | ### Last Login Report See the most recent login date and current account status for every user in a selected **User Directory** — making it easy to deduce which users have been inactive for over 30, 60, or 90 days. * Pick a directory from the drop-down near the upper-right of the page. * Search by name or email to find a specific user. * Users who have never signed in show as **Never Authenticated**. ### Login Activity Report Detailed authentication and login activity for your tenant. Filter by **username**, **MFA method**, **application**, and **date**. Click the link beside a user (under the **Date** column) to open the event, organized into: * **User** — first name, last name, username, email, directory source, user agent * **Application Info** — app name, app integration type * **Login Method** — authentication method, device name, device type * **Location Information** — user IP address Click **Show Details** for deeper data when auditing a report. ### Event Logs Detailed data on specific tenant events. Filter by **username**, **event type**, and **date**, then click any event and select **Show Details** for the full payload — including the aliases used for authentication. Tenant details are recorded on every log. Events are classified into categories: * **User Activity** — e.g., `E_LOGIN_SUCCEEDED`, `E_LOGIN_FAILED` * **Onboarding Activity** — `E_USER_INVITED`, `E_USER_ONBOARDED` * **Authentication Activity** — account lock/unlock, OTP and push events, rate-limit hits, password resets, device delinking, session termination, behavior authentication, and consent events * **Authentication Policy** — `E_AUTHPOLICY_CHECKED` records whether access was granted, denied, or required step-up * **Identity Verification** — `E_DOCUMENT_ENROLLED`, `E_DOCUMENT_UNENROLLED`, `E_USER_CONSENT` (no personally identifiable information is captured) * **Administrator Activity** — tagged with the `AUDIT_LOG` category; covers broker, role, directory, and IdP changes * **Reporting Activity** — `E_REPORT_REQUESTED`, `E_REPORT_GENERATED` {% hint style="info" %} **Note:** When authentication is performed via an auth proxy with client IP tracking enabled, the event payload differs and includes parameters such as `loginMethod`, `ipAddress`, `client_ip`, `radiusId`, and `referrer_name`.\ \ [Complete event reference here.](/identity-verification/core-concepts/event-reference.md) {% endhint %} ### Access Denied Report Detailed data on users who were denied access to your tenant. Access-denial decisions are executed based on the[ IP Address ](/authentication/admin-portal/authentication/setting-up-ip-based-authentication-journey-in-adminx.md)and [Geolocation ](/authentication/admin-portal/authentication/restricting-access-based-on-geolocation.md)authentication rules in effect for your tenant. The report shows **Date/Time**, **IP and Location Details**, and **Outcome**. Click a row, then **Show Details**, to see the full denied login attempt. ### Admin Activity Report A summary of all activities performed by other administrators across users — including activity types, the dates performed, and the users involved. * **Filter** — click **Filters**, specify a username, select an event type from the **Event** dropdown, and set the **From** and **To** dates. * **Download** — click **Download**; the report is delivered to your configured email address (processing takes a few minutes). Click the **here** link in the email to download the `.csv`. {% hint style="info" %} **Note:** The email download link expires in four days. {% endhint %} ### Admin Role Assignment Report View users who have been assigned privileged roles. Select a role from the **Select Role** drop-down and click **Download Report**. The generated report is emailed to the requester and can be downloaded from the report download section. ### Report Downloads Export and download **Event Logs** and **Login Activity** reports. Downloads are exported as `.csv` files for maximum compatibility across operating systems, and each report includes the requested event data, tenant details, and information about the account that initiated the download. **Add a report to the queue:** 1. Go to **Reports > Login Activity Report** or **Event Logs** (the process is the same for both). 2. Use the **Filters** bar to select date ranges, usernames, and other details. 3. Click **Download** to create a download job and add it to the queue. You can start multiple downloads without waiting for each to finish. **Download a completed report:** You'll receive an email with a direct download link when the report is ready. You can also open the **Report Downloads** page (under **Reports**), where reports are listed newest first — click the **paperclip icon** under the **Link** column. Only jobs with a **Completed** status can be downloaded. **Cancel a pending report:** On the **Report Downloads** page, click the **X icon** next to a pending job; its status becomes **Cancelled**. {% hint style="info" %} **Note:** Completed reports are available to download for seven days, after which they are deleted. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.1kosmos.com/authentication/admin-portal/monitoring-and-reporting.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.