Tooling for Auditing Auth0 Missing Active User (MAU)

When using Bulk User Exports and sorting by last_login, the count of users who logged in during a given month is far lower than the Monthly Active Users (MAU) count retrieved with the Get Active Users Count endpoint for the same month. This article explains why the quota link returns different results compared to bulk-user-exports.

• Auth0
• Monthly Active Users (MAU)
• Bulk User Exports
• Management Application Programming Interface (API)

The bulk-user-export endpoint retrieves the users for a determined database connection within the tenant specified in the request. 
If retrieving only the users for one of the databases, users who may be using other databases in the tenant and logged in that same month would be missing.

Using the bulk-export-users is not the most practical way to audit the External Active Users for a tenant. 

To obtain this information, admins can use the Quota Utilization reports in the Support Center or the get_active_users endpoint of the Management API.

For MAU, logins are not counted; instead, active usage is measured. The most important measure of usage is the number of active users. A user is considered to be active in a given month if they have generated a log of user activity with their user_id. Each tenant this user logs into will create a new user profile with a unique user_id on that tenant.

To count the MAUs, it is necessary to query tenant logs for successful login events.
Auth0 MAU usage calculation also includes, for instance, Refresh Token as a log of user activity, so the successful exchange of Refresh Token for Access Token is a successful authentication event. In consequence, the following log event types would be considered successful login authentication when counting Active Users: 

s: Successful login
sepft: Successful exchange of password for token
ssa: Successful silent authentication
seoobft: Successful exchange of Password and OOB Challenge for Access Token
seotpft: Successful exchange of Password and OTP Challenge for Access Token
sercft: Successful exchange of Password and MFA Recovery code for Access Token
sertft: Successful exchange of Refresh Token for Access Token
seacft: Successful exchange of authorization code for Access Token
scoa: Success cross-origin authentication
sens: Successful native social exchange

NOTE: When querying tenant logs, the active usage count is limited by the tenant's log retention period. In this scenario, using a Log Streaming service could help build a new way to present this data over the long term, but that would require manual setup. More information about Log Streaming can be found here: Log Streams.