Order of Fields in ZTA Enrollment Logs
|
Not all the fields that are listed are found in most or all requests. When a field does not
have a value, Secure Access sets the field to the empty string ( |
Optional V13 Log Header Format
The CSV fields in the header row of the Optional Log header are as follows:
"Timestamp","Identity Email","Identity Labels","Identity Type Labels","Organization ID","MSP Organization ID","Enrollment ID","Event Type","Enrollment Method","Event Detail","OS Type & Version","ZTA Client Version","Event Status","Device ID","Public IP"
V13 Log Format
The CSV fields in the header row of the ZTA enrollment log are as follows:
timestamp,identity email,identity labels,identity type labels,organization id,msp organization id,enrollment id,event type,enrollment method,event detail,os type & version,zta client version,event status,device id,public ip
The following table provides the description for each field and the log version in which it was introduced, up to Version 13. For more information about log versions, see Find Your Log Schema Version.
| Field name | Description | Release version | ||
|---|---|---|---|---|
| timestamp | The date and time of the ZTA enrollment event, displayed as a UTC-formatted
string, for example, 2026-01-16 17:48:41.
|
v13 | ||
| identity email | The email address of the Active Directory user initiating the enrollment or unenrollment. | v13 | ||
| identity labels | The list of labels associated with the identity. | v13 | ||
| identity type labels | The label specifying the identity type. | v13 | ||
| organization id |
The unique identifier for the Secure Access organization. For more information, see Find Your Organization ID. |
v13 | ||
| msp organization id | The Secure Access organization ID of the parent-managed service provider. | v13 | ||
| enrollment id | The unique transaction ID for the enrollment or unenrollment process. | v13 | ||
| event type | The type of enrollment event. Valid values are: ENROLL or
UNENROLL. |
v13 | ||
| enrollment method | The authentication method used for enrollment. Valid values are:
SAML, CERTIFICATE, or
BOTH. |
v13 | ||
| event detail | Additional context for the event, including reasons for enrollment failure. | v13 | ||
| os type & version | The operating system name and version of the client device. | v13 | ||
| zta client version | The version of the ZTA client installed in the device. | v13 | ||
| event status | The status of the enrollment event, for example, successfully enrolled or failure status details. | v13 | ||
| device id | The unique identifier assigned to the enrolled or unenrolled device. | v13 | ||
| public ip | The public IP address of the client device. | v13 |