What is an identity-provider log?¶
An identity-provider log records activity handled by a service that authenticates users and supplies identity information to other applications.
Examples include cloud identity platforms, single sign-on services and directory systems.
Avoid this assumption: That an identity-provider entry proves the named person personally logged in and performed the later activity. It does not.
The identity provider may record sign-in attempts, successful authentication, multi-factor challenges, token issuance, application access, account changes and risk detections. It may contain the account, application, source IP address, device information, authentication method, result, session or correlation ID and timestamp.
This can be valuable because one identity service may sit in front of many applications. A single set of records may help establish when an account authenticated, which application requested access and what security checks were applied.
But authentication and later activity are separate questions. A token may be reused after the original login. A session may continue without another password prompt. An application, service account or delegated administrator may act using identity information issued earlier.
The account field also identifies an account, not automatically a person. Credentials may be shared, stolen or used from a remotely controlled device. Location and risk labels may be inferred from network and behavioural information rather than directly measured.
Investigators should identify the provider, tenant, event type and application involved. Ask whether the record relates to primary authentication, single sign-on, token refresh, multi-factor approval or session continuation. Preserve correlation IDs and linked sign-in, application and audit records.
Where attribution matters, correlate with endpoint, device-management, network, application and communications evidence.
Operational takeaway¶
An identity-provider log can show how an account was authenticated or issued access, but it does not by itself prove who controlled the account, device, token or later session.