Problem
You want to confirm why a user account has been suspended, and the Admin log events says Actor: super admin account, they show that the super admin is suspending the user, however, the admin is not manually suspending the user.
Environment
- Admin console
- Reporting
Solution
- In your Google Admin console.
- On the left, click on Reporting > Audit and investigation > OAuth log events.
- Click on + Add a filter > User > type the email address of the admin suspending the user.
- Click Search.
Cause
The suspension is being performed with the API due to a third party app that has been authorized to make changes on behalf of the admin account.