3732106 - Cannot audit historical onboarding email notifications due to log retention - identity authentication

• An Identity Authentication tenant connected to a SuccessFactors source system sent email notifications (password reset/activation) to onboarding users on a specific date.
• An external onboarding user reported receiving a password reset email from Identity Authentication.
• The team needs to determine how many onboarding users received these emails for that date.
• When searching audit logs for entries with action=sendMail and successful status, events from that earlier date are no longer available.

SAP SuccessFactors Onboarding

1. Configure transformations so that onboarding users receive email notifications from Identity Authentication.
2. On a specific date, Identity Authentication processed jobs that sent password reset/activation emails to onboarding users.
3. A user reports receipt of the password reset email.
4. Attempt to audit and count recipients by checking Identity Authentication logs for action=sendMail events for that date.

Identity Authentication retains email and audit log data only for a limited period and automatically purges older entries; events outside the retention window (including action=sendMail with successful status) are not available for review.

1. Access Identity Authentication logs for the relevant timeframe that is still within the system’s retention window.
2. Filter the audit log for entries where action=sendMail and status indicates success, and refine further to password reset/activation emails for onboarding users.
3. Compile the count of matching events to determine the number of emails sent.
4. If the target date falls outside the log retention window, note that it is not possible to retrieve historical counts because the system has purged those entries by design.
5. Implement operational practices to preserve history going forward, such as regularly exporting or backing up Identity Authentication audit logs within the retention period for future auditing needs.

• refer to: 2978346 - How to check if e-mails are sent and the sender from Identity Authentication Service
• refer to: 3460129 - IAS Notification credentials - Onboarding

ias, identity authentication, onboarding, email notifications, password reset, activation email, sendMail, audit log, event audit, log retention, purge, historical logs, count recipients, successfactors integration, audit window , KBA , LOD-SF-OBX-IAS , IAS User Authentication , How To