Private IP from gd_unenroll log
Last Updated:
Overview
When a user's authenticators are removed via a DELETE call to the /v2/users/{id}/authenticators Management API endpoint, the corresponding gd_unenroll event in the tenant logs shows a private, internal Auth0 IP address instead of the public IP address of the administrator or system that initiated the request. This can cause confusion during security and audit reviews.
Applies To
- Management API
- IPs
- Log events
- MFA delete authenticators
Solution
This behavior is expected. The DELETE /v2/users/{id}/authenticators API call triggers an internal, asynchronous process within Auth0’s infrastructure to remove the authenticator factors from the user's profile. The gd_unenroll log event is generated by this backend service upon the successful removal of a device.
Therefore, the IP address recorded in the gd_unenroll log is that of the internal Auth0 service that executed the deletion, not the original caller.
