The User Authentications Export feature enables administrators to export user authentication events into a spreadsheet for reporting, auditing, and troubleshooting.
The export includes all eligible authentication event attributes, including both visible and hidden fields available to the administrator.
Export generation is performed asynchronously to ensure optimal performance regardless of the number of authentication events.
Note
The exported data reflects the state of the database at the time the export is processed. Because exports are generated asynchronously, they do not represent a transactional snapshot of the data at the moment the export request is submitted.
Permissions
The Export action is available only to administrators with the following permissions:
- Data Protection
- Review all authentication events
Export user authentications
To export authentication events:
- Navigate to Users > Authentications.
- Apply filters if required.
- Click Export.
Select the export period
A dialog is displayed allowing the administrator to define the export period.
The administrator can:
- Select a Start Date
- Select an End Date
- Choose one of the predefined ranges:
- Last week
- Last 2 weeks
- Last month
- Last 3 months
- Last 6 months
- Last year
Click Start to begin the export.
Screenshot: User Authentications Export dialog.
Time range limitations
Authentication exports are generated only for events whose Event time falls within the selected period.
The maximum selectable period is 365 days (1 year).
For example:
- Current date and time: March 25, 2026 – 3:15 PM
- Earliest selectable date: March 25, 2025 – 3:15 PM
- Latest selectable date: March 25, 2026 – 3:15 PM
Selecting a period larger than one year is not permitted.
Export generation
Once Start is clicked:
- an asynchronous backend export task is created;
- the administrator may continue using the platform while the export is generated;
- a progress dialog indicates that the export is being processed.
When the export is complete, the generated file is automatically downloaded by the browser.
Exported columns
The exported file contains the following columns:
| Column name | Description |
|---|---|
| Event time (UTC) | Authentication event date and time expressed in UTC |
| Identifier | User identifier used during authentication |
| Location | Location where the authentication occurred |
| Token | Authentication token / account used |
| MAC address | Device MAC address, when available |
| Browser | Browser detected during authentication |
| Device | Operating system / device type |
| Authentication | Authentication method |
| Status | Authentication result |
Export scope
The exported dataset:
- includes only authentication events within the selected Event time range;
- includes all eligible fields
- respects the administrator's permissions and tenant scope;
- reflects the data available when the asynchronous export task is processed.
Notes
- Export generation is asynchronous.
- Export duration depends on the number of authentication events matching the selected period.
- The export reflects the data available at processing time (no snapshot guarantee).
- Authentication events created, updated, or removed while the export is running may affect the final exported file.
- The Event time column in the exported file is expressed in UTC.