Using File System Items Source in Astera Centerprise.UI Walkthrough - Astera Centerprise Data Integrator.Centerprise Best Practices Part 1 - Dataflows.OIDC-Authentication by single sign-on OpenID Connect (OIDC).Includes sign-ins to less secure apps (if allowed) Google Password-Used a Google password.It might also indicate the user was already signed in to a session when they signed in to another, and the 2 sessions were merged Exchange-When a user is authenticated by token exchange, such as via an OAuth login.Applicable only to the login_success event True if the sign-in attempt was suspicious, otherwise false. False if the user didn't sign in with 2-factor authentication. True if the user signed in with 2-factor authentication. Usually the address is the user's physical location, but it can be a proxy server or a Virtual Private Network (VPN) address. IP address that the user used to sign in. Note: For the Logout event, even if the user signed in with login types other than Google Password, (such as Exchange, Reauth, SAML, or Unknown), the Login type for Logout events is displayed as Google Password. The logged event action, such as 2-step verification enroll or Suspicious login The type of challenge used to verify the user, such as Password or Security Key.ĭate and time of the event (displayed in your browser's default time zone)Įmail address to forward the Gmail messages to If there’s no data for user log events during the previous 6 months, User log events might not be displayed in the left navigation menu.įor a full list of services and activities that you can investigate, such as Google Drive or user activity, read through the data sources for the audit and investigation page.Įmail address of the user who performed the action.For more details, see What's new: Improved audit and investigation experience. During a recent launch, the old Login audit log and User accounts audit log were combined into the User log events data source.These actions include changes to passwords, account recovery details (telephone numbers, email addresses), and 2-Step Verification enrollment. If a user signs in from an email client or a non-browser application, you can also review reports of suspicious attempts. There you can check critical actions carried out by users on their own accounts. You can use the audit and investigation page to run searches related to User log events. For information about this change, go to Improved audit and investigation experience: What's new in Google Workspace. The audit log page has been replaced with a new audit and investigation page.

Google drive api get last logged in