Admin Audit Activity Events - Mobile Settings

This document lists the events and parameters for Mobile Settings Admin Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=admin.

Mobile Settings

Events of this type are returned with type=MOBILE_SETTINGS.

Action Cancelled On Device

Event details
Event name	ACTION_CANCELLED
Parameters	ACTION_ID string The mobile device action's ID. ACTION_TYPE string The type of action taken on the mobile device. Possible values: ACCOUNT_WIPE ALLOW_ACCESS APPROVE BLOCK COLLECT_BUGREPORT DEVICE_WIPE DISALLOW_ACCESS LOCATE_DEVICE LOCK_DEVICE REMOVE_APP_FROM_DEVICE REMOVE_IOS_PROFILE RESET_PIN REVOKE_TOKEN RING_DEVICE SYNC_DEVICE UNKNOWN DEVICE_ID string The device's ID. DEVICE_TYPE string The device's type. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ACTION_CANCELLED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{ACTION_TYPE} with id {ACTION_ID} on device type {DEVICE_TYPE} and id {DEVICE_ID} was cancelled by user {USER_EMAIL}

Action Requested On Device

Event details
Event name	ACTION_REQUESTED
Parameters	ACTION_ID string The mobile device action's ID. ACTION_TYPE string The type of action taken on the mobile device. Possible values: ACCOUNT_WIPE ALLOW_ACCESS APPROVE BLOCK COLLECT_BUGREPORT DEVICE_WIPE DISALLOW_ACCESS LOCATE_DEVICE LOCK_DEVICE REMOVE_APP_FROM_DEVICE REMOVE_IOS_PROFILE RESET_PIN REVOKE_TOKEN RING_DEVICE SYNC_DEVICE UNKNOWN DEVICE_ID string The device's ID. DEVICE_TYPE string The device's type. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ACTION_REQUESTED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{ACTION_TYPE} with id {ACTION_ID} on device type {DEVICE_TYPE} and id {DEVICE_ID} was requested by user {USER_EMAIL}

Add Mobile certificate

Event details
Event name	ADD_MOBILE_CERTIFICATE
Parameters	DOMAIN_NAME string The primary domain name. MOBILE_CERTIFICATE_COMMON_NAME string The mobile certificate common name. ORG_UNIT_NAME string The organizational unit (OU) name (path).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_MOBILE_CERTIFICATE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Mobile certificate {MOBILE_CERTIFICATE_COMMON_NAME} added for mobile devices in your organization

Apple DEP sync triggered by admin

Event details
Event name	APPLE_DEP_SYNC_TRIGGERED
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=APPLE_DEP_SYNC_TRIGGERED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Apple DEP sync triggered by {USER_EMAIL}

Apple DEP token setup complete for customer

Event details
Event name	APPLE_DEP_TOKEN_SETUP_COMPLETE
Parameters	USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=APPLE_DEP_TOKEN_SETUP_COMPLETE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Apple Device Enrollment tokens updated by {USER_EMAIL}

Apple VPP token operation

Event details
Event name	APPLE_VPP_TOKEN_OPERATION
Parameters	TOKEN_OPERATION_NAME string Apple VPP token operation name. Possible values: DELETE The message for when Apple VPP Token is deleted. SYNC The message for when Apple VPP Token is synced. UPLOAD The message for when Apple VPP Token is uploaded. TOKEN_OPERATION_STATUS string Apple VPP token operation status. Possible values: SUCCESSFUL The message for when Token operation is successful. UNSUCCESSFUL The message for when Token operation is unsuccessful.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=APPLE_VPP_TOKEN_OPERATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Apple VPP token {TOKEN_OPERATION_NAME} was {TOKEN_OPERATION_STATUS}

Bulk import of company owned devices

Event details
Event name	COMPANY_DEVICES_BULK_CREATION
Parameters	NUMBER_OF_COMPANY_OWNED_DEVICES integer The number of devices a company owns.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=COMPANY_DEVICES_BULK_CREATION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Details of {NUMBER_OF_COMPANY_OWNED_DEVICES} company owned device(s) were imported

Company owned device blocked

Event details
Event name	COMPANY_OWNED_DEVICE_BLOCKED
Parameters	COMPANY_DEVICE_ID string The company-owned mobile device ID. DEVICE_TYPE string The device's type.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=COMPANY_OWNED_DEVICE_BLOCKED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Company owned device {COMPANY_DEVICE_ID} was blocked

Company owned device deleted

Event details
Event name	COMPANY_DEVICE_DELETION
Parameters	COMPANY_DEVICE_ID string The company-owned mobile device ID. DEVICE_TYPE string The device's type.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=COMPANY_DEVICE_DELETION&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Company owned device {COMPANY_DEVICE_ID} was deleted

Company owned device unblocked

Event details
Event name	COMPANY_OWNED_DEVICE_UNBLOCKED
Parameters	COMPANY_DEVICE_ID string The company-owned mobile device ID. DEVICE_TYPE string The device's type.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=COMPANY_OWNED_DEVICE_UNBLOCKED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Company owned device {COMPANY_DEVICE_ID} was unblocked

Company owned device wiped

Event details
Event name	COMPANY_OWNED_DEVICE_WIPED
Parameters	COMPANY_DEVICE_ID string The company-owned mobile device ID. DEVICE_TYPE string The device's type.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=COMPANY_OWNED_DEVICE_WIPED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Company owned device {COMPANY_DEVICE_ID} was wiped

Customer user device deleted

Event details
Event name	CUSTOMER_USER_DEVICE_DELETION_EVENT
Parameters	COMPANY_DEVICE_ID string The company-owned mobile device ID. DEVICE_TYPE string The device's type.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CUSTOMER_USER_DEVICE_DELETION_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Customer user device {COMPANY_DEVICE_ID} was deleted

Mobile application permission grant change

Change in mobile application permission grant.

Event details
Event name	CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT
Parameters	DEVICE_TYPE string The device's type. DISTRIBUTION_ENTITY_NAME string The distribution entity value, which can be a group name or an org-unit name. Possible values: ANY A label that targets any distribution. DISTRIBUTION_ENTITY_TYPE string The distribution entity type, which can be a group or an org-unit. Possible values: GROUP A distribution entity label for a Google group. ORG_UNIT A distribution entity label for an organizational unit. USER A distribution entity label for a user. MOBILE_APP_PACKAGE_ID string The mobile application package ID. NEW_PERMISSION_GRANT_STATE string The new permission grant state. Possible values: DENIED GRANTED PROMPT OLD_PERMISSION_GRANT_STATE string The old permission grant state. Possible values: DENIED GRANTED PROMPT PERMISSION_GROUP_NAME string Description for permission group name. Possible values: CALENDAR CAMERA CONTACTS LOCATION MICROPHONE PHONE SENSORS SMS STORAGE
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Changed grant state of {PERMISSION_GROUP_NAME} from {OLD_PERMISSION_GRANT_STATE} to {NEW_PERMISSION_GRANT_STATE} for {DEVICE_TYPE} application {MOBILE_APP_PACKAGE_ID} for {DISTRIBUTION_ENTITY_NAME} {DISTRIBUTION_ENTITY_TYPE}

Mobile application priority order change

Change in priority order of mobile application.

Event details
Event name	CHANGE_MOBILE_APPLICATION_PRIORITY_ORDER
Parameters	DEVICE_TYPE string The device's type. MOBILE_APP_PACKAGE_ID string The mobile application package ID.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_MOBILE_APPLICATION_PRIORITY_ORDER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Priority order of {DEVICE_TYPE} application {MOBILE_APP_PACKAGE_ID} was changed

Mobile application removed from whitelist

Event details
Event name	REMOVE_MOBILE_APPLICATION_FROM_WHITELIST
Parameters	DEVICE_TYPE string The device's type. DISTRIBUTION_ENTITY_NAME string The distribution entity value, which can be a group name or an org-unit name. Possible values: ANY A label that targets any distribution. DISTRIBUTION_ENTITY_TYPE string The distribution entity type, which can be a group or an org-unit. Possible values: GROUP A distribution entity label for a Google group. ORG_UNIT A distribution entity label for an organizational unit. USER A distribution entity label for a user. MOBILE_APP_PACKAGE_ID string The mobile application package ID.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_MOBILE_APPLICATION_FROM_WHITELIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{DEVICE_TYPE} application {MOBILE_APP_PACKAGE_ID} is no longer whitelisted for {DISTRIBUTION_ENTITY_NAME} {DISTRIBUTION_ENTITY_TYPE}

Mobile application setting change

Change in mobile application setting.

Event details
Event name	CHANGE_MOBILE_APPLICATION_SETTINGS
Parameters	DEVICE_TYPE string The device's type. DISTRIBUTION_ENTITY_NAME string The distribution entity value, which can be a group name or an org-unit name. Possible values: ANY A label that targets any distribution. DISTRIBUTION_ENTITY_TYPE string The distribution entity type, which can be a group or an org-unit. Possible values: GROUP A distribution entity label for a Google group. ORG_UNIT A distribution entity label for an organizational unit. USER A distribution entity label for a user. MOBILE_APP_PACKAGE_ID string The mobile application package ID. NEW_VALUE string The new SETTING_NAME value that was set during this event. OLD_VALUE string The previous SETTING_NAME value that was replaced during this event. SETTING_NAME string The unique name (ID) of the setting that was changed.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_MOBILE_APPLICATION_SETTINGS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Changed {SETTING_NAME} app setting from {OLD_VALUE} to {NEW_VALUE} for {DEVICE_TYPE} application {MOBILE_APP_PACKAGE_ID} for {DISTRIBUTION_ENTITY_NAME} {DISTRIBUTION_ENTITY_TYPE}

Mobile application whitelisted

Mobile application is added to whitelist.

Event details
Event name	ADD_MOBILE_APPLICATION_TO_WHITELIST
Parameters	DEVICE_TYPE string The device's type. DISTRIBUTION_ENTITY_NAME string The distribution entity value, which can be a group name or an org-unit name. Possible values: ANY A label that targets any distribution. DISTRIBUTION_ENTITY_TYPE string The distribution entity type, which can be a group or an org-unit. Possible values: GROUP A distribution entity label for a Google group. ORG_UNIT A distribution entity label for an organizational unit. USER A distribution entity label for a user. MOBILE_APP_PACKAGE_ID string The mobile application package ID.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_MOBILE_APPLICATION_TO_WHITELIST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{DEVICE_TYPE} application {MOBILE_APP_PACKAGE_ID} is whitelisted for {DISTRIBUTION_ENTITY_NAME} {DISTRIBUTION_ENTITY_TYPE}

Mobile Device Approve

Event details
Event name	MOBILE_DEVICE_APPROVE
Parameters	DEVICE_ID string The device's ID. DEVICE_TYPE string The device's type. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MOBILE_DEVICE_APPROVE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Mobile device for {USER_EMAIL} approved

Mobile Device Block

Event details
Event name	MOBILE_DEVICE_BLOCK
Parameters	DEVICE_ID string The device's ID. DEVICE_TYPE string The device's type. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MOBILE_DEVICE_BLOCK&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Mobile device for {USER_EMAIL} blocked

Mobile Device Deletion

Event details
Event name	MOBILE_DEVICE_DELETE
Parameters	DEVICE_ID string The device's ID. DEVICE_TYPE string The device's type. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MOBILE_DEVICE_DELETE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Mobile device for {USER_EMAIL} deleted

Mobile Device Wipe

Event details
Event name	MOBILE_DEVICE_WIPE
Parameters	DEVICE_ID string The device's ID. DEVICE_TYPE string The device's type. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MOBILE_DEVICE_WIPE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Mobile device for {USER_EMAIL} wiped

Mobile Setting Change

Event details
Event name	CHANGE_MOBILE_SETTING
Parameters	DOMAIN_NAME string The primary domain name. NEW_VALUE string The new SETTING_NAME value that was set during this event. OLD_VALUE string The previous SETTING_NAME value that was replaced during this event. ORG_UNIT_NAME string The organizational unit (OU) name (path). SETTING_NAME string The unique name (ID) of the setting that was changed.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_MOBILE_SETTING&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{SETTING_NAME} for mobile devices in your organization changed from {OLD_VALUE} to {NEW_VALUE}

Mobile Setting Change: Administrator Restrictions Pin

Event details
Event name	CHANGE_ADMIN_RESTRICTIONS_PIN
Parameters	DOMAIN_NAME string The primary domain name. ORG_UNIT_NAME string The organizational unit (OU) name (path).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_ADMIN_RESTRICTIONS_PIN&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Administrator restrictions PIN for mobile devices in your organization changed

Mobile Wireless Network Change

Event details
Event name	CHANGE_MOBILE_WIRELESS_NETWORK
Parameters	DOMAIN_NAME string The primary domain name. MOBILE_WIRELESS_NETWORK_NAME string The mobile wireless network name. ORG_UNIT_NAME string The organizational unit (OU) name (path).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_MOBILE_WIRELESS_NETWORK&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Mobile wireless network {MOBILE_WIRELESS_NETWORK_NAME} changed for mobile devices in your organization

Mobile Wireless Network Creation

Event details
Event name	ADD_MOBILE_WIRELESS_NETWORK
Parameters	DOMAIN_NAME string The primary domain name. MOBILE_WIRELESS_NETWORK_NAME string The mobile wireless network name. ORG_UNIT_NAME string The organizational unit (OU) name (path).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_MOBILE_WIRELESS_NETWORK&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Mobile wireless network {MOBILE_WIRELESS_NETWORK_NAME} created for mobile devices in your organization

Mobile Wireless Network Deletion

Event details
Event name	REMOVE_MOBILE_WIRELESS_NETWORK
Parameters	DOMAIN_NAME string The primary domain name. MOBILE_WIRELESS_NETWORK_NAME string The mobile wireless network name. ORG_UNIT_NAME string The organizational unit (OU) name (path).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_MOBILE_WIRELESS_NETWORK&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Mobile wireless network {MOBILE_WIRELESS_NETWORK_NAME} deleted for mobile devices in your organization

Mobile Wireless Network Password Change

Event details
Event name	CHANGE_MOBILE_WIRELESS_NETWORK_PASSWORD
Parameters	DOMAIN_NAME string The primary domain name. MOBILE_WIRELESS_NETWORK_NAME string The mobile wireless network name. ORG_UNIT_NAME string The organizational unit (OU) name (path).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CHANGE_MOBILE_WIRELESS_NETWORK_PASSWORD&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Password changed for mobile wireless network {MOBILE_WIRELESS_NETWORK_NAME} in your organization

Remove Mobile certificate

Event details
Event name	REMOVE_MOBILE_CERTIFICATE
Parameters	DOMAIN_NAME string The primary domain name. MOBILE_CERTIFICATE_COMMON_NAME string The mobile certificate common name. ORG_UNIT_NAME string The organizational unit (OU) name (path).
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_MOBILE_CERTIFICATE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Mobile certificate {MOBILE_CERTIFICATE_COMMON_NAME} removed for mobile devices in your organization

Use Google Device Management

Google Device Management is a part of the Google Admin console.

Event details
Event name	ENROLL_FOR_GOOGLE_DEVICE_MANAGEMENT
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ENROLL_FOR_GOOGLE_DEVICE_MANAGEMENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Enrolled for Google Device Management

Use Google Mobile Management

Event details
Event name	USE_GOOGLE_MOBILE_MANAGEMENT
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USE_GOOGLE_MOBILE_MANAGEMENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	You have selected Google Mobile Management to manage all your mobile devices

Use Google Mobile Management for Android and Active Sync devices

Event details
Event name	USE_GOOGLE_MOBILE_MANAGEMENT_FOR_NON_IOS
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USE_GOOGLE_MOBILE_MANAGEMENT_FOR_NON_IOS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	You have selected Google Mobile Management to manage your Android and Active Sync devices

Use Google Mobile Management for iOS devices

Event details
Event name	USE_GOOGLE_MOBILE_MANAGEMENT_FOR_IOS
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=USE_GOOGLE_MOBILE_MANAGEMENT_FOR_IOS&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	You have selected Google Mobile Management to manage your iOS devices

Wipe Mobile Account

Event details
Event name	MOBILE_ACCOUNT_WIPE
Parameters	DEVICE_ID string The device's ID. DEVICE_TYPE string The device's type. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MOBILE_ACCOUNT_WIPE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Mobile account for {USER_EMAIL} has been wiped

Wipe On Mobile Cancel And Approve Device

Event details
Event name	MOBILE_DEVICE_CANCEL_WIPE_THEN_APPROVE
Parameters	DEVICE_ID string The device's ID. DEVICE_TYPE string The device's type. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MOBILE_DEVICE_CANCEL_WIPE_THEN_APPROVE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Wipe on mobile device for {USER_EMAIL} was cancelled and the device was approved

Wipe On Mobile Cancel And Block Device

Event details
Event name	MOBILE_DEVICE_CANCEL_WIPE_THEN_BLOCK
Parameters	DEVICE_ID string The device's ID. DEVICE_TYPE string The device's type. USER_EMAIL string The user's primary email address.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=MOBILE_DEVICE_CANCEL_WIPE_THEN_BLOCK&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Wipe on mobile device for {USER_EMAIL} was cancelled and the device has been blocked