How to confirm what causes an automatic user suspension

Problem

You want to confirm why a user account has been suspended, and the Admin log events says Actor: super admin account, they show that the super admin is suspending the user, however, the admin is not manually suspending the user.

Environment

  • Admin console
  • Reporting

Solution

  1. Log in to the Admin console.
  2. Navigate to Reporting > Audit and investigation > OAuth log events.
  3. Click on + Add a filter > User > type the email address of the admin suspending the user.
  4. Click Search.
    • Note: These logs will show any third party app performing API calls to the directory API and this will help to find what app is making the changes on behalf of the admin. 

 

Cause

The suspension is performed with the API due to a third party app that has been authorized to make changes on behalf of the admin account.