---
schema_version: "1"
id: 67c3335f37d60a53264f511edd7396fca5cc217915db746497f16526293d5580
title: Use the Identity Provider Event Log
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/identity_provider_error_log.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.identity_provider_error_log.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 531dbc8c2197678f6109d1ec40ae6b6882866529fba5e9727177e02e8ee86c26
description: When you're using Salesforce as an identity provider, use the identity provider event log to see information about login attempts. For example, see why login attempts failed so you can troubleshoot problems with your single sign-on (SSO) configuration. The log shows you the 50 most recent login attempts. To view more, create a custom report.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Use the Identity Provider Event Log

When you're using Salesforce as an identity provider, use the identity provider event log to see information about login attempts. For example, see why login attempts failed so you can troubleshoot problems with your single sign-on (SSO) configuration. The log shows you the 50 most recent login attempts. To view more, create a custom report.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Developer</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Database.com</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d39316e75">User Permissions
              Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d39316e75 ">Define and modify identity providers and service providers:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d39316e75 ">Customize Application</td>

          </tr>
        </tbody>
      </table>

1. From Setup, in the Quick Find box, enter Identity Provider Event Log, then select **Identity Provider Event Log**.
2. By default, the log shows you all login attempts. To see errors or successes only, click the dropdown arrow and choose **Show errors only** or **Show successes only**.
    
    The log displays information in these fields. <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
            <colgroup>
              <col style="width:50%">
              <col style="width:50%">
            </colgroup>
            <thead class="slds-text-title_caps ">
              <tr class="">
                <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d39316e128">Field</th>
                <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d39316e130">Description</th>
              </tr>
            </thead>
            <tbody>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d39316e128 ">Username</td>
                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d39316e130 ">The username of the user who attempted to log in.</td>
              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d39316e128 ">Usage Type</td>
                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d39316e130 ">
                  <p>The login flow used for the attempt.</p>
                  <ul>
                    <li>Identity provider-initiated SAML</li>
                    <li>OAuth authorization</li>
                    <li>OAuth token exchange</li>
                    <li>Service provider-initiated SAML</li>
                  </ul>
                </td>
              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d39316e128 ">Timestamp</td>
                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d39316e130 ">The date and time of the login attempt. For example, 7/20/2025,
                  12:15:30 PM PDT.</td>
              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d39316e128 ">Entity ID</td>
                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d39316e130 ">The entity ID of the connected app.</td>
              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d39316e128 ">Status</td>
                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d39316e130 ">
                  <p>The status of the login attempt.</p>
                  <ul>
                    <li>Error: App access denied—The user isn't permitted to use the
                      OAuth-enabled connected app. For example, they don't have the
                      right permission set or profile.</li>
                    <li>Error: App blocked—An admin blocked access to the connected
                      app.</li>
                    <li>Error: Custom field not found—Salesforce couldn't find the
                      field for the subject custom attribute used to identify the
                      user.</li>
                    <li>Error: Expired authorization code</li>
                    <li>Error: IdP certificate is invalid or does not exist</li>
                    <li>Error: Internal Error—An unidentified error occurred within
                      Salesforce.</li>
                    <li>Error: Invalid authorization code</li>
                    <li>Error: Invalid client credentials</li>
                    <li>Error: Invalid device ID</li>
                    <li>Error: Invalid grant—There was a problem with the OAuth flow.
                      This error also displays a specific reason for the problem, such
                      as an expired token.</li>
                    <li>Error: Invalid Identity Provider Endpoint URL</li>
                    <li>Error: Invalid Issuer</li>
                    <li>Error: Invalid scope(s)</li>
                    <li>Error: Invalid session level—The session policy for the
                      connected app is invalid or wasn't satisfied.</li>
                    <li>Error: Invalid Signature—Something is wrong with the signature
                      in the SAML assertion.</li>
                    <li>Error: Invalid spoke SP settings—In the Environment Hub, the
                      service provider orgs aren't configured properly for the
                      identity provider org.</li>
                    <li>Error: Invalid user credentials</li>
                    <li>Error: Misconfigured or invalid service provider</li>
                    <li>Error: No Spoke ID found—For Environment Hub orgs, the identity
                      provider org couldn't find the ID of the service provider
                      org.</li>
                    <li>Error: Unable to parse AuthnRequest from service provider</li>
                    <li>Error: User does not have access to this service provider—The
                      user isn't permitted to use the SAML-enabled connected app. For
                      example, they don't have the right permission set or
                      profile.</li>
                    <li>Error: User does not have a Federation Identifier selected</li>
                    <li>Error: User does not have a value for the subject custom
                      attribute</li>
                    <li>Error: Unable to resolve request into a Service Provider</li>
                    <li>OAuth Error—A problem occurred with the OAuth flow, but
                      Salesforce couldn't identify the cause.</li>
                    <li>Success</li>
                    <li>Unknown Error—An unidentified error unrelated to Salesforce
                      occurred. For example, the user lost internet connection.</li>
                    <li>User logged out due to forced authentication request</li>
                  </ul>
                </td>
              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d39316e128 ">Service Provider</td>
                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d39316e130 ">The connected app the user tried to access.</td>
              </tr>
            </tbody>
          </table>To see all login attempts, create a custom report. For more information, see [Set Up a Custom Report Type.](https://help.salesforce.com/articleView?id=xcloud.reports_report_type_setup.htm&type=5&language=en_US)