> ## Documentation Index
> Fetch the complete documentation index at: https://help.skillsdb.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM Event Log

> Audit trail for every SCIM provisioning event SkillsDB receives. Filter by event type, source, group, and date to verify sync activity or troubleshoot problems.

<Info>
  **Quick Summary:** The SCIM Event Log records every provisioning event SkillsDB receives, including user creation, updates, deactivations, group changes, and career assignments. Use it to verify a sync worked or to diagnose why a user did not appear.
</Info>

## Overview

The SCIM Event Log is an audit trail for every SCIM event that SkillsDB processes. Each row represents one action triggered by your identity provider, the SCIM background sync, or an administrator.

Use the event log to:

* Verify that a specific user or group change was processed
* Diagnose why a user is missing, deactivated, or has the wrong permission level
* Track permission changes and manager reassignments over time
* Export a filtered audit trail for compliance reporting

The event log is admin-only and covers events from your company only. Events from other SkillsDB customers are not visible.

## Prerequisites

Before using the event log, make sure you have:

* **Permission level**: SkillsDB administrator
* **Setup requirement**: An active SCIM connection (see [SCIM Setup](/identity-and-provisioning/scim-setup))
* **Access requirement**: **Settings > SSO & SCIM > Configure SSO and SCIM settings**, then select **Event Log**

## How to open the event log

<Steps>
  <Step title="Open the SSO & SCIM settings">
    Navigate to **Settings > SSO & SCIM** and select **Configure SSO and SCIM settings**.
  </Step>

  <Step title="Open the Event Log">
    In the top right of the page, select **Event Log**. The event log page opens with the most recent events first.
  </Step>
</Steps>

The event log page has two controls at the top:

* **Export** downloads the currently filtered events as an Excel file (`scim_event_log_YYYY-MM-DD.xlsx`)
* **Refresh** refetches the event list

## What each column shows

| Column | What it shows                                                                                   |
| ------ | ----------------------------------------------------------------------------------------------- |
| Event  | Human-readable description of what happened. For updates, shows the old and new values.         |
| Type   | The event type — one of ten categories listed in the next section. Shown as a colored badge.    |
| Person | The user the event affected. Empty for group-only events like `Group Created`.                  |
| Group  | The SCIM group the event relates to. Empty for events that do not involve a group.              |
| Source | Where the event came from: **Webhook**, **Cron Sync**, or **Manual**.                           |
| When   | Event timestamp in `MMM d, HH:mm` format. Hover to see the full date, day of week, and seconds. |

## Event types

The event log has ten event types, each representing a specific action. The **Event Type** filter in the toolbar lets you filter by one or more types simultaneously.

| Event type      | What it means                                                                                                                                                                   |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Provisioned     | A new user was created in SkillsDB from a SCIM event.                                                                                                                           |
| Updated         | An existing SCIM-provisioned user had their attributes, manager, or group membership updated.                                                                                   |
| Deprovisioned   | A user was deactivated because they were removed from SCIM, disabled in the IdP, or had all groups removed.                                                                     |
| Group Created   | A new SCIM group was registered in SkillsDB (either default, auto-created from an IdP event, or admin-created).                                                                 |
| Group Updated   | An existing SCIM group was modified (permission level, description, or automations).                                                                                            |
| Group Deleted   | A custom SCIM group was deleted or deactivated. (Default groups cannot be deleted — see [SCIM Groups and Permissions](/identity-and-provisioning/scim-groups-and-permissions).) |
| Member Added    | A user was added to a SCIM group.                                                                                                                                               |
| Member Removed  | A user was removed from a SCIM group.                                                                                                                                           |
| Career Assigned | A career automation ran and assigned a career to a user. See [SCIM Career Automations](/identity-and-provisioning/scim-career-automations).                                     |
| Permission      | A user's effective SkillsDB permission level changed (for example, Basic → Admin).                                                                                              |

## Event sources

The **Source** column shows where the event originated:

* **Webhook** — The event came from your identity provider through Stytch. This is the most common source for real-time provisioning activity.
* **Cron Sync** — The event came from SkillsDB's scheduled background sync. This sync retries manager assignments that failed during the initial provisioning and periodically reconciles group memberships.
* **Manual** — The event was triggered by a SkillsDB administrator action, such as creating or editing a custom SCIM group.

## How to filter events

The toolbar above the event table supports four filter types. Filters can be combined.

| Filter     | Options                                                                                       |
| ---------- | --------------------------------------------------------------------------------------------- |
| Event Type | Multi-select from the ten event types listed above.                                           |
| Source     | Select one of **Webhook**, **Cron Sync**, or **Manual**.                                      |
| Group      | Select a specific SCIM group. Populated dynamically from groups that appear in the log.       |
| Date       | Preset range: **Today**, **Yesterday**, **Last 7 days**, **Last 30 days**, or **This month**. |

Filters update the table immediately. Use **Export** to download the currently filtered results as an Excel file.

## How to diagnose a provisioning problem

The event log is the fastest way to find out why a user is missing or has the wrong state. Use these patterns as starting points:

### Problem: A user who should be in SkillsDB is missing

<Steps>
  <Step title="Filter by Event Type: Provisioned">
    Set the **Event Type** filter to **Provisioned** and set a **Date** range covering when the user was added in your identity provider.
  </Step>

  <Step title="Look for the user">
    If you see a **Provisioned** event for the user, SCIM created them successfully — check whether they were subsequently deprovisioned. If no **Provisioned** event appears, the SCIM event for that user never reached SkillsDB.
  </Step>

  <Step title="Check your identity provider">
    In Entra, verify the user is assigned to the SCIM application and belongs to at least one of the provisioning groups. Use **Provision on Demand** in Entra to push the user immediately. See [SCIM Setup](/identity-and-provisioning/scim-setup) and [Azure Sync Considerations](/identity-and-provisioning/azure-sync-considerations).
  </Step>
</Steps>

### Problem: A user has the wrong permission level

<Steps>
  <Step title="Filter by Event Type: Permission and the user">
    Set **Event Type** to **Permission** to see every permission-level change. The **Event** column shows the old value and the new value.
  </Step>

  <Step title="Check group memberships">
    Filter by the user's name in a People view filtered by SCIM group membership, or check the **Member Added** and **Member Removed** events in the log for that user.
  </Step>

  <Step title="Review custom group configuration">
    If the user is in a custom SCIM group, confirm the group's permission level in **Settings > SSO & SCIM**. See [SCIM Groups and Permissions](/identity-and-provisioning/scim-groups-and-permissions).
  </Step>
</Steps>

### Problem: A career automation did not run

<Steps>
  <Step title="Filter by Event Type: Career Assigned and the user">
    If the automation ran, there will be a **Career Assigned** event for the user within the expected time window.
  </Step>

  <Step title="Check the automation scope">
    If the scope is **First provisioning only** and the user was already a member of the group, the automation will not re-run. See [SCIM Career Automations](/identity-and-provisioning/scim-career-automations).
  </Step>

  <Step title="Confirm the automation exists">
    Open the custom SCIM group's edit modal and confirm the automation is still attached and the career still exists.
  </Step>
</Steps>

## Common Questions

<AccordionGroup>
  <Accordion title="How long are events kept in the log?">
    SkillsDB retains SCIM event log entries for ongoing audit and troubleshooting. Contact SkillsDB Support if you need to export or purge events for compliance reasons.
  </Accordion>

  <Accordion title="Why don't I see events for users who signed in but weren't provisioned via SCIM?">
    The SCIM Event Log only records provisioning events. Sign-in activity is separate from SCIM and does not appear in this log. Users who sign in via SSO but were created manually in SkillsDB will not appear here.
  </Accordion>

  <Accordion title="Can I see events from before SCIM was enabled?">
    No. The event log starts when SCIM is first configured for your company. Events before that point are not available.
  </Accordion>

  <Accordion title="What does a Cron Sync event mean?">
    SkillsDB runs a scheduled background sync to fix manager assignments that couldn't be made during initial provisioning (because the manager was provisioned after the direct report) and to reconcile group memberships. Events from this background sync are tagged with **Cron Sync** as their source.
  </Accordion>

  <Accordion title="Can non-admins see the event log?">
    No. The event log is visible only to SkillsDB administrators. Users without admin permission do not see the **Event Log** button on the SSO & SCIM settings page.
  </Accordion>
</AccordionGroup>

## Related Articles

<CardGroup cols={2}>
  <Card title="SCIM Setup" icon="gear" href="/identity-and-provisioning/scim-setup">
    Configure SCIM provisioning — the event log populates once SCIM is connected.
  </Card>

  <Card title="SCIM Groups and Permissions" icon="users-gear" href="/identity-and-provisioning/scim-groups-and-permissions">
    Understand how group membership drives the permission changes you see in the log.
  </Card>

  <Card title="SCIM Career Automations" icon="briefcase" href="/identity-and-provisioning/scim-career-automations">
    How Career Assigned events are generated and when they do not run.
  </Card>

  <Card title="Azure Sync Considerations" icon="triangle-exclamation" href="/identity-and-provisioning/azure-sync-considerations">
    Known Entra limitations that explain unexpected events (or missing events) in the log.
  </Card>
</CardGroup>

## Need More Help?

If you see events that do not match what you expect, or need to investigate a specific sync incident, reach out to your organization's SkillsDB administrator or contact [SkillsDB Support](https://www.skillsdb.com/support).