Overview
This article addresses the situation in which the device ID of a user’s MFA behavior is needed and explains how to obtain it.
Solution
The log type that will provide the device_id is gd_send_pn (Push notification sent).
Search the tenant logs in the Dashboard with the following query syntax to find all logs of that type generated for that user:
type:"gd_send_pn" AND user_id:"USER_ID"
The device_id of the user will be in the logs the above query will result in.