Hello all!
New to this forum, but I was interested in what this account was floating around in our Datadog logs - it appears that it’s a service account for Okta to push app updates but I wanted to verify this before I tune any of our rules to exclude this behaviour.
Thanks in advance!
Email: supportuser@okta.com
User ID: spr3wdy9zSMzoCsGE5d6
Log events showing the actor supportuser@okta.com are typically from Okta Support team members reviewing details of your org during the course of working on a support case, with the Event Info for these events stating “Okta initiated org view”.
If you have questions about any specific events you are seeing, you can also open a support case for additional assistance.