# Device Audit Activity Events

This document lists the events and parameters for
various types of
Device Audit activity events. You can retrieve these events by
calling [Activities.list()](https://developers.google.com/workspace/admin/reports/v1/reference/activities/list)
with `applicationName=mobile`.

## Device Applications


Device applications events in Mobile device.
Events of this type are returned with `type=device_applications`.

### Device application change

| Event details ||
|---|---|
| Event name | `APPLICATION_EVENT` |
| Parameters | |---|---| | `APK_SHA256_HASH` | `string` Parameter to indicate the SHA-256 hash of an application. | | `APPLICATION_ID` | `string` Parameter to indicate the Application Id. | | `APPLICATION_STATE` | `string` Parameter to indicate the application install/uninstall/update done on device. Possible values: - `INSTALLED` Application install event. - `NOT_PHA` Potentially harmful application not flagged event. - `PHA` Potentially harmful application detection event. - `UNINSTALLED` Application uninstall event. - `UPDATED` Application version update event. | | `DEVICE_ID` | `string` Parameter to indicate the Device Id. | | `DEVICE_MODEL` | `string` Parameter to indicate the device model. | | `DEVICE_TYPE` | `string` Parameter to indicate the device type. Possible values: - `ANDROID` Android. - `ASSISTANT` Assistant. - `DESKTOP_CHROME` Desktop Chrome. - `iOS` iOS. - `LINUX` Linux. - `MAC` Mac. - `WINDOWS` Windows. | | `IOS_VENDOR_ID` | `string` Parameter to indicate the iOS Vendor Id. | | `NEW_VALUE` | `string` Parameter to indicate the new value. | | `PHA_CATEGORY` | `string` Potentially harmful app category reported by SafetyNet. Possible values: - `BACKDOOR` EnumParameter to indicate that application package potentially contains a backdoor. - `CALL_FRAUD` EnumParameter to indicate that application package potentially contains call fraud. - `DATA_COLLECTION` EnumParameter to indicate that application package potentially contains data collection capabilities. - `DENIAL_OF_SERVICE` EnumParameter to indicate that application package potentially contains denial of service logic. - `FRAUDWARE` EnumParameter to indicate that application package is potentially fraudware. - `GENERIC_MALWARE` EnumParameter to indicate that application package is potentially malware. - `HARMFUL_SITE` EnumParameter to indicate that application package potentially contains harmful sites. - `HOSTILE_DOWNLOADER` EnumParameter to indicate that application package is potentially a hostile downloader. - `NON_ANDROID_THREAT` EnumParameter to indicate that application package potentially contains threats to non-Android systems. - `PHISHING` EnumParameter to indicate that application package potentially contains phishing. - `PRIVILEGE_ESCALATION` EnumParameter to indicate that application package potentially contains privilege escalation capabilities. - `RANSOMWARE` EnumParameter to indicate that application package is potentially ransomware. - `ROOTING` EnumParameter to indicate that application package potentially contains rooting capabilities. - `SPAM` EnumParameter to indicate that application package potentially contains spam. - `SPYWARE` EnumParameter to indicate that application package is potentially spyware. - `TOLL_FRAUD` EnumParameter to indicate that application package potentially contains toll fraud. - `TRACKING` EnumParameter to indicate that application package potentially contains tracking logic. - `TROJAN` EnumParameter to indicate that application package potentially contains a trojan. - `UNCOMMON` EnumParameter to indicate that application package is uncommon. - `WAP_FRAUD` EnumParameter to indicate that application package potentially contains WAP fraud. - `WINDOWS_MALWARE` EnumParameter to indicate that application package potentially contains windows malware. | | `RESOURCE_ID` | `string` Parameter to indicate the unique resource id of a device. | | `SECURITY_EVENT_ID` | `integer` Security event id. | | `SERIAL_NUMBER` | `string` Parameter to indicate the Serial number. | | `USER_EMAIL` | `string` Parameter to indicate the User email. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=APPLICATION_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{APPLICATION_ID} version {NEW_VALUE} was {APPLICATION_STATE} {actor}'s {DEVICE_MODEL}` |

### Device application report

| Event details ||
|---|---|
| Event name | `APPLICATION_REPORT_EVENT` |
| Parameters | |---|---| | `APPLICATION_ID` | `string` Parameter to indicate the Application Id. | | `APPLICATION_MESSAGE` | `string` Parameter to indicate the message sent by an application report. | | `APPLICATION_REPORT_KEY` | `string` Parameter to indicate the key of an application message. | | `APPLICATION_REPORT_SEVERITY` | `string` Parameter to indicate the severity of a report. Possible values: - `ERROR` EnumParameter to indicate the application report severity is error. - `INFO` EnumParameter to indicate the application report severity is informational. - `UNKNOWN` EnumParameter to indicate the application report severity is unknown. | | `APPLICATION_REPORT_TIMESTAMP` | `integer` Parameter to indicate the timestamp of a report. | | `DEVICE_APP_COMPLIANCE` | `string` Parameter to indicate the managed app compliance state with managed application configurations. Possible values: - `COMPLIANT` Compliant devices. - `NON_COMPLIANT` Non-compliant devices. | | `DEVICE_ID` | `string` Parameter to indicate the Device Id. | | `DEVICE_MODEL` | `string` Parameter to indicate the device model. | | `DEVICE_TYPE` | `string` Parameter to indicate the device type. Possible values: - `ANDROID` Android. - `ASSISTANT` Assistant. - `DESKTOP_CHROME` Desktop Chrome. - `iOS` iOS. - `LINUX` Linux. - `MAC` Mac. - `WINDOWS` Windows. | | `RESOURCE_ID` | `string` Parameter to indicate the unique resource id of a device. | | `SERIAL_NUMBER` | `string` Parameter to indicate the Serial number. | | `USER_EMAIL` | `string` Parameter to indicate the User email. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=APPLICATION_REPORT_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{APPLICATION_ID} reported a status of severity:{APPLICATION_REPORT_SEVERITY} for application key:{APPLICATION_REPORT_KEY} with the message:'{APPLICATION_MESSAGE}'` |

## Device Updates


Device update events in Mobile device.
Events of this type are returned with `type=device_updates`.

### Account registration change

| Event details ||
|---|---|
| Event name | `DEVICE_REGISTER_UNREGISTER_EVENT` |
| Parameters | |---|---| | `ACCOUNT_STATE` | `string` Parameter to indicate the account state on the device, eg: registered/unregistered. Possible values: - `REGISTERED` Register type event. - `UNREGISTERED` Unregister type event. | | `BASIC_INTEGRITY` | `string` Parameter to indicate whether the device passes the basic integrity check. | | `CTS_PROFILE_MATCH` | `string` Parameter to indicate whether the device passes the CTS profile match. | | `DEVICE_ID` | `string` Parameter to indicate the Device Id. | | `DEVICE_MODEL` | `string` Parameter to indicate the device model. | | `DEVICE_TYPE` | `string` Parameter to indicate the device type. Possible values: - `ANDROID` Android. - `ASSISTANT` Assistant. - `DESKTOP_CHROME` Desktop Chrome. - `iOS` iOS. - `LINUX` Linux. - `MAC` Mac. - `WINDOWS` Windows. | | `IOS_VENDOR_ID` | `string` Parameter to indicate the iOS Vendor Id. | | `OS_VERSION` | `string` Parameter to indicate the OS version. | | `REGISTER_PRIVILEGE` | `string` Parameter to indicate Device Policy app's privilege on the user's device. Possible values: - `DEVICE_ADMINISTRATOR` Device administrator privilege. - `DEVICE_OWNER` Device owner privilege. - `PROFILE_OWNER` Work profile privilege. | | `RESOURCE_ID` | `string` Parameter to indicate the unique resource id of a device. | | `SECURITY_PATCH_LEVEL` | `string` Parameter to indicate the security patch Level. | | `SERIAL_NUMBER` | `string` Parameter to indicate the Serial number. | | `USER_EMAIL` | `string` Parameter to indicate the User email. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_REGISTER_UNREGISTER_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{actor}'s account {ACCOUNT_STATE} {DEVICE_MODEL} {REGISTER_PRIVILEGE}` |

### Advanced Policy Sync event

Advanced Policy Sync events.

| Event details ||
|---|---|
| Event name | `ADVANCED_POLICY_SYNC_EVENT` |
| Parameters | |---|---| | `DEVICE_ID` | `string` Parameter to indicate the Device Id. | | `DEVICE_MODEL` | `string` Parameter to indicate the device model. | | `DEVICE_TYPE` | `string` Parameter to indicate the device type. Possible values: - `ANDROID` Android. - `ASSISTANT` Assistant. - `DESKTOP_CHROME` Desktop Chrome. - `iOS` iOS. - `LINUX` Linux. - `MAC` Mac. - `WINDOWS` Windows. | | `NEW_VALUE` | `string` Parameter to indicate the new value. | | `OS_EDITION` | `string` Parameter to indicate the Windows OS edition. | | `OS_VERSION` | `string` Parameter to indicate the OS version. | | `POLICY_NAME` | `string` Parameter to indicate the policy name. | | `POLICY_SYNC_RESULT` | `string` Parameter to indicate the policy status. Possible values: - `POLICY_SYNC_ABORTED` EnumParameter to indicate that policy sync is aborted. - `POLICY_SYNC_FAILED` EnumParameter to indicate that policy sync is failed. - `POLICY_SYNC_SUCCEEDED` EnumParameter to indicate that policy sync is successful. | | `POLICY_SYNC_TYPE` | `string` Parameter to indicate the policy sync type. Possible values: - `POLICY_APPLIED_TYPE` EnumParameter to indicate that policy is applied. - `POLICY_REMOVED_TYPE` EnumParameter to indicate that policy is removed. | | `RESOURCE_ID` | `string` Parameter to indicate the unique resource id of a device. | | `SERIAL_NUMBER` | `string` Parameter to indicate the Serial number. | | `USER_EMAIL` | `string` Parameter to indicate the User email. | | `VALUE` | `string` Parameter to indicate the value of a field. | | `WINDOWS_SYNCML_POLICY_STATUS_CODE` | `string` Parameter to indicate the policy status code. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=ADVANCED_POLICY_SYNC_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{POLICY_SYNC_TYPE} {POLICY_NAME} {NEW_VALUE}{VALUE} {DEVICE_TYPE} policy {POLICY_SYNC_RESULT} on {actor}'s {DEVICE_MODEL} with serial id {SERIAL_NUMBER}` |

### Device Action event

Device Action events.

| Event details ||
|---|---|
| Event name | `DEVICE_ACTION_EVENT` |
| Parameters | |---|---| | `ACTION_EXECUTION_STATUS` | `string` The execution status of an action. Possible values: - `ACTION_REJECTED_BY_USER` Action Rejected by User action execution status. - `CANCELLED` Cancelled action execution status. - `EXECUTED` Executed action execution status. - `FAILED` Failed action execution status. - `PENDING` Pending action execution status. - `SENT_TO_DEVICE` Sent to Device action execution status. - `UNKNOWN` Display name for Unknown action execution status. | | `ACTION_ID` | `string` Unique identifier for an action. | | `ACTION_TYPE` | `string` The type of an action. Possible values: - `ACCOUNT_WIPE` Account Wipe action type. - `ALLOW_ACCESS` Allow Access action type. - `APPROVE` Approve action type. - `BLOCK` Block action type. - `COLLECT_BUGREPORT` Collect Bugreport action type. - `DEVICE_WIPE` Device Wipe action type. - `DISALLOW_ACCESS` Disallow Access action type. - `LOCATE_DEVICE` Locate Device action type. - `LOCK_DEVICE` Lock Device action type. - `REMOVE_APP_FROM_DEVICE` Remove App action type. - `REMOVE_IOS_PROFILE` Remove iOS Profile action type. - `RESET_PIN` Reset PIN action type. - `REVOKE_TOKEN` Revoke Token action type. - `RING_DEVICE` Ring Device action type. - `SIGN_OUT_USER` Sign out user action type. - `SYNC_DEVICE` Sync Device action type. - `UNENROLL` Unenrolls a device from Windows Advanced management. - `UNKNOWN` Unknown action type. | | `DEVICE_ID` | `string` Parameter to indicate the Device Id. | | `DEVICE_MODEL` | `string` Parameter to indicate the device model. | | `DEVICE_TYPE` | `string` Parameter to indicate the device type. Possible values: - `ANDROID` Android. - `ASSISTANT` Assistant. - `DESKTOP_CHROME` Desktop Chrome. - `iOS` iOS. - `LINUX` Linux. - `MAC` Mac. - `WINDOWS` Windows. | | `IOS_VENDOR_ID` | `string` Parameter to indicate the iOS Vendor Id. | | `RESOURCE_ID` | `string` Parameter to indicate the unique resource id of a device. | | `SERIAL_NUMBER` | `string` Parameter to indicate the Serial number. | | `USER_EMAIL` | `string` Parameter to indicate the User email. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_ACTION_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{ACTION_TYPE} with id {ACTION_ID} on {actor}'s {DEVICE_MODEL} was {ACTION_EXECUTION_STATUS}` |

### Device compliance status

| Event details ||
|---|---|
| Event name | `DEVICE_COMPLIANCE_CHANGED_EVENT` |
| Parameters | |---|---| | `DEVICE_COMPLIANCE` | `string` Parameter to indicate the device compliance state with set policies. Possible values: - `COMPLIANT` Compliant devices. - `NON_COMPLIANT` Non-compliant devices. | | `DEVICE_DEACTIVATION_REASON` | `string` Parameter to indicate the reason for the deactivation of the mobile device. Possible values: - `CAMERA_NOT_DISABLED` The device has been deactivated because camera is not disabled on the device. - `DEVICE_BLOCKED_BY_ADMIN` The device has been deactivated because it has been blocked by the admin. - `DEVICE_COMPROMISED` Device is compromised. - `DEVICE_MODEL_NOT_ALLOWED` The device has been deactivated because the device model is not allowed by the admin. - `DEVICE_NOT_ENCRYPTED` The device has been deactivated because the device is not encrypted. - `DEVICE_POLICY_APP_REQUIRED` The device has been deactivated because the Device Policy App is not installed. - `DMAGENT_NOT_DEVICE_OWNER` The device has been deactivated because it's Device Policy app is not device owner. - `DMAGENT_NOT_LATEST` The device has been deactivated because it does not have the latest version of the Device Policy app. - `DMAGENT_NOT_PROFILE_OR_DEVICE_OWNER` The device has been deactivated because it's Device Policy app is neither profile owner nor device owner. - `IOS_ROOTED_STATUS_STALE` The device has been deactivated because the iOS rooted status is stale. - `KEYGUARD_NOT_DISABLED` The device has been deactivated because lock screen widgets are not disabled on the device. - `OS_VERSION_TOO_OLD` The device has been deactivated because the operating system version is older than required by the admin. - `PASSWORD_POLICY_NOT_SATISFIED` The device has been deactivated because the password policy is not satisfied. - `SECURITY_PATCH_TOO_OLD` The device has been deactivated because the security patch on the device is older than required by the admin. - `SYNC_DISABLED` The device has been deactivated because sync is not enabled for this device. | | `DEVICE_ID` | `string` Parameter to indicate the Device Id. | | `DEVICE_MODEL` | `string` Parameter to indicate the device model. | | `DEVICE_TYPE` | `string` Parameter to indicate the device type. Possible values: - `ANDROID` Android. - `ASSISTANT` Assistant. - `DESKTOP_CHROME` Desktop Chrome. - `iOS` iOS. - `LINUX` Linux. - `MAC` Mac. - `WINDOWS` Windows. | | `RESOURCE_ID` | `string` Parameter to indicate the unique resource id of a device. | | `SERIAL_NUMBER` | `string` Parameter to indicate the Serial number. | | `USER_EMAIL` | `string` Parameter to indicate the User email. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_COMPLIANCE_CHANGED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{actor}'s {DEVICE_MODEL} is {DEVICE_COMPLIANCE} {DEVICE_DEACTIVATION_REASON}` |

### Device OS update

| Event details ||
|---|---|
| Event name | `OS_UPDATED_EVENT` |
| Parameters | |---|---| | `DEVICE_ID` | `string` Parameter to indicate the Device Id. | | `DEVICE_MODEL` | `string` Parameter to indicate the device model. | | `DEVICE_TYPE` | `string` Parameter to indicate the device type. Possible values: - `ANDROID` Android. - `ASSISTANT` Assistant. - `DESKTOP_CHROME` Desktop Chrome. - `iOS` iOS. - `LINUX` Linux. - `MAC` Mac. - `WINDOWS` Windows. | | `IOS_VENDOR_ID` | `string` Parameter to indicate the iOS Vendor Id. | | `NEW_VALUE` | `string` Parameter to indicate the new value. | | `OLD_VALUE` | `string` Parameter to indicate the old value. | | `OS_PROPERTY` | `string` Parameter to indicate OS Property, eg: OS version. Possible values: - `BASEBAND_VERSION` Device baseband version. - `BUILD_NUMBER` Build number. - `KERNEL_VERSION` Kernel version. - `OS_VERSION` OS version. - `SECURITY_PATCH` OS security patch. | | `RESOURCE_ID` | `string` Parameter to indicate the unique resource id of a device. | | `SERIAL_NUMBER` | `string` Parameter to indicate the Serial number. | | `USER_EMAIL` | `string` Parameter to indicate the User email. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=OS_UPDATED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{OS_PROPERTY} updated on {actor}'s {DEVICE_MODEL} from {OLD_VALUE} to {NEW_VALUE}` |

### Device ownership

Device ownership events.

| Event details ||
|---|---|
| Event name | `DEVICE_OWNERSHIP_CHANGE_EVENT` |
| Parameters | |---|---| | `DEVICE_ID` | `string` Parameter to indicate the Device Id. | | `DEVICE_MODEL` | `string` Parameter to indicate the device model. | | `DEVICE_OWNERSHIP` | `string` Parameter to indicate the ownership of mobile device. Possible values: - `COMPANY_OWNED` The ownership of this device has been changed to company owned. - `USER_OWNED` The ownership of this device has been changed to user owned. | | `DEVICE_TYPE` | `string` Parameter to indicate the device type. Possible values: - `ANDROID` Android. - `ASSISTANT` Assistant. - `DESKTOP_CHROME` Desktop Chrome. - `iOS` iOS. - `LINUX` Linux. - `MAC` Mac. - `WINDOWS` Windows. | | `NEW_DEVICE_ID` | `string` Parameter to indicate the new Device Id. | | `RESOURCE_ID` | `string` Parameter to indicate the unique resource id of a device. | | `SERIAL_NUMBER` | `string` Parameter to indicate the Serial number. | | `USER_EMAIL` | `string` Parameter to indicate the User email. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_OWNERSHIP_CHANGE_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Ownership of {actor}'s {DEVICE_MODEL} has changed to {DEVICE_OWNERSHIP}, with new device id {NEW_DEVICE_ID}` |

### Device settings change

| Event details ||
|---|---|
| Event name | `DEVICE_SETTINGS_UPDATED_EVENT` |
| Parameters | |---|---| | `DEVICE_ID` | `string` Parameter to indicate the Device Id. | | `DEVICE_MODEL` | `string` Parameter to indicate the device model. | | `DEVICE_SETTING` | `string` Parameter to indicate device settings, eg: USB debugging setting. Possible values: - `DEVELOPER_OPTIONS` Developer options. - `UNKNOWN_SOURCES` Unknown sources. - `USB_DEBUGGING` USB debugging. - `VERIFY_APPS` Verify apps. | | `DEVICE_TYPE` | `string` Parameter to indicate the device type. Possible values: - `ANDROID` Android. - `ASSISTANT` Assistant. - `DESKTOP_CHROME` Desktop Chrome. - `iOS` iOS. - `LINUX` Linux. - `MAC` Mac. - `WINDOWS` Windows. | | `NEW_VALUE` | `string` Parameter to indicate the new value. Possible values: - `OFF` off. - `ON` on. | | `OLD_VALUE` | `string` Parameter to indicate the old value. Possible values: - `OFF` off. - `ON` on. | | `RESOURCE_ID` | `string` Parameter to indicate the unique resource id of a device. | | `SERIAL_NUMBER` | `string` Parameter to indicate the Serial number. | | `USER_EMAIL` | `string` Parameter to indicate the User email. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_SETTINGS_UPDATED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{DEVICE_SETTING} changed from {OLD_VALUE} to {NEW_VALUE} by {actor} on {DEVICE_MODEL}` |

### Device status changed on Apple portal

| Event details ||
|---|---|
| Event name | `APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT` |
| Parameters | |---|---| | `DEVICE_STATUS_ON_APPLE_PORTAL` | `string` Parameter to indicate the device status on Apple portal. Possible values: - `ADDED` EnumParameter to indicate the device is added on Apple portal. - `DELETED` EnumParameter to indicate the device is deleted on Apple portal. | | `SERIAL_NUMBER` | `string` Parameter to indicate the Serial number. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Device with serial number {SERIAL_NUMBER} {DEVICE_STATUS_ON_APPLE_PORTAL} through Apple Device Enrollment` |

### Device Sync

Device Sync events.

| Event details ||
|---|---|
| Event name | `DEVICE_SYNC_EVENT` |
| Parameters | |---|---| | `BASIC_INTEGRITY` | `string` Parameter to indicate whether the device passes the basic integrity check. | | `CTS_PROFILE_MATCH` | `string` Parameter to indicate whether the device passes the CTS profile match. | | `DEVICE_ID` | `string` Parameter to indicate the Device Id. | | `DEVICE_MODEL` | `string` Parameter to indicate the device model. | | `DEVICE_TYPE` | `string` Parameter to indicate the device type. Possible values: - `ANDROID` Android. - `ASSISTANT` Assistant. - `DESKTOP_CHROME` Desktop Chrome. - `iOS` iOS. - `LINUX` Linux. - `MAC` Mac. - `WINDOWS` Windows. | | `IOS_VENDOR_ID` | `string` Parameter to indicate the iOS Vendor Id. | | `OS_VERSION` | `string` Parameter to indicate the OS version. | | `RESOURCE_ID` | `string` Parameter to indicate the unique resource id of a device. | | `SECURITY_PATCH_LEVEL` | `string` Parameter to indicate the security patch Level. | | `SERIAL_NUMBER` | `string` Parameter to indicate the Serial number. | | `USER_EMAIL` | `string` Parameter to indicate the User email. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_SYNC_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{actor}'s account synced on {DEVICE_MODEL}` |

### Risk signal change

| Event details ||
|---|---|
| Event name | `RISK_SIGNAL_UPDATED_EVENT` |
| Parameters | |---|---| | `DEVICE_ID` | `string` Parameter to indicate the Device Id. | | `DEVICE_MODEL` | `string` Parameter to indicate the device model. | | `DEVICE_TYPE` | `string` Parameter to indicate the device type. Possible values: - `ANDROID` Android. - `ASSISTANT` Assistant. - `DESKTOP_CHROME` Desktop Chrome. - `iOS` iOS. - `LINUX` Linux. - `MAC` Mac. - `WINDOWS` Windows. | | `IOS_VENDOR_ID` | `string` Parameter to indicate the iOS Vendor Id. | | `NEW_VALUE` | `string` Parameter to indicate the new value. | | `OLD_VALUE` | `string` Parameter to indicate the old value. | | `RESOURCE_ID` | `string` Parameter to indicate the unique resource id of a device. | | `RISK_SIGNAL` | `string` Parameter to indicate the risk signal, e.g. CTS profile match. Possible values: - `BASIC_INTEGRITY` EnumParameter to indicate whether the device passes the basic integrity check. - `CTS_PROFILE_MATCH` EnumParameter to indicate whether the device passes the CTS profile match. | | `SERIAL_NUMBER` | `string` Parameter to indicate the Serial number. | | `USER_EMAIL` | `string` Parameter to indicate the User email. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=RISK_SIGNAL_UPDATED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{RISK_SIGNAL} updated on {actor}'s {DEVICE_MODEL} from {OLD_VALUE} to {NEW_VALUE}` |

### Work profile support

| Event details ||
|---|---|
| Event name | `ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT` |
| Parameters | |---|---| | `DEVICE_ID` | `string` Parameter to indicate the Device Id. | | `DEVICE_MODEL` | `string` Parameter to indicate the device model. | | `DEVICE_TYPE` | `string` Parameter to indicate the device type. Possible values: - `ANDROID` Android. - `ASSISTANT` Assistant. - `DESKTOP_CHROME` Desktop Chrome. - `iOS` iOS. - `LINUX` Linux. - `MAC` Mac. - `WINDOWS` Windows. | | `RESOURCE_ID` | `string` Parameter to indicate the unique resource id of a device. | | `SERIAL_NUMBER` | `string` Parameter to indicate the Serial number. | | `USER_EMAIL` | `string` Parameter to indicate the User email. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `Work profile is supported on {actor}'s {DEVICE_MODEL}` |

## Suspicious Activity


Suspicious activity events in Mobile device.
Events of this type are returned with `type=suspicious_activity`.

### Device compromise

Device compromised.

| Event details ||
|---|---|
| Event name | `DEVICE_COMPROMISED_EVENT` |
| Parameters | |---|---| | `DEVICE_COMPROMISED_STATE` | `string` Parameter to indicate the compromised state of device. Possible values: - `COMPROMISED` Device is compromised. - `NOT_COMPROMISED` Device is no longer compromised. | | `DEVICE_ID` | `string` Parameter to indicate the Device Id. | | `DEVICE_MODEL` | `string` Parameter to indicate the device model. | | `DEVICE_TYPE` | `string` Parameter to indicate the device type. Possible values: - `ANDROID` Android. - `ASSISTANT` Assistant. - `DESKTOP_CHROME` Desktop Chrome. - `iOS` iOS. - `LINUX` Linux. - `MAC` Mac. - `WINDOWS` Windows. | | `IOS_VENDOR_ID` | `string` Parameter to indicate the iOS Vendor Id. | | `RESOURCE_ID` | `string` Parameter to indicate the unique resource id of a device. | | `SERIAL_NUMBER` | `string` Parameter to indicate the Serial number. | | `USER_EMAIL` | `string` Parameter to indicate the User email. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_COMPROMISED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{actor}'s {DEVICE_MODEL} {DEVICE_COMPROMISED_STATE}` |

### Failed screen unlock attempts

| Event details ||
|---|---|
| Event name | `FAILED_PASSWORD_ATTEMPTS_EVENT` |
| Parameters | |---|---| | `DEVICE_ID` | `string` Parameter to indicate the Device Id. | | `DEVICE_MODEL` | `string` Parameter to indicate the device model. | | `DEVICE_TYPE` | `string` Parameter to indicate the device type. Possible values: - `ANDROID` Android. - `ASSISTANT` Assistant. - `DESKTOP_CHROME` Desktop Chrome. - `iOS` iOS. - `LINUX` Linux. - `MAC` Mac. - `WINDOWS` Windows. | | `FAILED_PASSWD_ATTEMPTS` | `integer` Parameter to indicate the number of failed screen unlock attempts. | | `RESOURCE_ID` | `string` Parameter to indicate the unique resource id of a device. | | `SERIAL_NUMBER` | `string` Parameter to indicate the Serial number. | | `USER_EMAIL` | `string` Parameter to indicate the User email. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=FAILED_PASSWORD_ATTEMPTS_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{FAILED_PASSWD_ATTEMPTS} failed attempts to unlock {actor}'s {DEVICE_MODEL}` |

### Suspicious activity

| Event details ||
|---|---|
| Event name | `SUSPICIOUS_ACTIVITY_EVENT` |
| Parameters | |---|---| | `DEVICE_ID` | `string` Parameter to indicate the Device Id. | | `DEVICE_MODEL` | `string` Parameter to indicate the device model. | | `DEVICE_PROPERTY` | `string` Parameter to indicate the changed device property. Possible values: - `BASIC_INTEGRITY` EnumParameter to indicate whether the device passes the basic integrity check. - `CTS_PROFILE_MATCH` EnumParameter to indicate whether the device passes the CTS profile match. - `DEVICE_BOOTLOADER` Bootloader version on the device. - `DEVICE_BRAND` Device brand. - `DEVICE_HARDWARE` Device hardware details. - `DEVICE_MANUFACTURER` Manufacturer of the device. - `DEVICE_MODEL` Device model. - `DMAGENT_PERMISSION` Device Policy app's privilege on the device. - `IMEI_NUMBER` IMEI number. - `MEID_NUMBER` MEID number. - `SERIAL_NUMBER` Serial number. - `WIFI_MAC_ADDRESS` WiFi MAC address. | | `DEVICE_TYPE` | `string` Parameter to indicate the device type. Possible values: - `ANDROID` Android. - `ASSISTANT` Assistant. - `DESKTOP_CHROME` Desktop Chrome. - `iOS` iOS. - `LINUX` Linux. - `MAC` Mac. - `WINDOWS` Windows. | | `IOS_VENDOR_ID` | `string` Parameter to indicate the iOS Vendor Id. | | `NEW_VALUE` | `string` New value. The possible values listed below only apply when `DEVICE_PROPERTY` is set to `DMAGENT_PERMISSION`. For other properties this parameter will contain arbitrary string values. Possible values: - `DEVICE_ADMINISTRATOR` Device administrator privilege. - `DEVICE_OWNER` Device owner privilege. - `PROFILE_OWNER` Profile owner privilege. - `UNKNOWN_PERMISSION` Unknown privilege. | | `OLD_VALUE` | `string` Old value. The possible values listed below only apply when `DEVICE_PROPERTY` is set to `DMAGENT_PERMISSION`. For other properties this parameter will contain arbitrary string values. Possible values: - `DEVICE_ADMINISTRATOR` Device administrator privilege. - `DEVICE_OWNER` Device owner privilege. - `PROFILE_OWNER` Profile owner privilege. - `UNKNOWN_PERMISSION` Unknown privilege. | | `RESOURCE_ID` | `string` Parameter to indicate the unique resource id of a device. | | `SERIAL_NUMBER` | `string` Parameter to indicate the Serial number. | | `USER_EMAIL` | `string` Parameter to indicate the User email. | |
| Sample request | `GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=SUSPICIOUS_ACTIVITY_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN` |
| Admin Console message format | `{DEVICE_PROPERTY} changed on {actor}'s {DEVICE_MODEL} from {OLD_VALUE} to {NEW_VALUE}` |