Hello Okta team,
I am trying to identify both failed and successful social IdP logins for each app. To retrieve the app name for successful social IdP logins, I was able to use the "user.authentication.auth_via_social"
eventType and find the app name by referencing the subsequent "policy.evaluate_sign_on"
eventType.
However, for failed social IdP logins, I do not see a "policy.evaluate_sign_on"
event following the failed "user.authentication.auth_via_social"
eventType.
Is there any way to retrieve the app name the user is trying to access via social IdP when the login fails?