New to this forum, but I was interested in what this account was floating around in our Datadog logs - it appears that it’s a service account for Okta to push app updates but I wanted to verify this before I tune any of our rules to exclude this behaviour.
Log events showing the actor supportuser@okta.com are typically from Okta Support team members reviewing details of your org during the course of working on a support case, with the Event Info for these events stating “Okta initiated org view”.
If you have questions about any specific events you are seeing, you can also open a support case for additional assistance.