Problem statement: Is it possible to query tenant logs to see which admin made changes to a specific user?
For Example: I would like to check to see who made updates to the app_metdata of a particular user.
Solution: One method for retrieving such information is to perform a log search with the following query: details.request.path: "/api/v2/users/auth0%7Cabc123" where auth0%7Cabc123 is replaced with your user’s user_id after it’s been URL Encoded.
Within the body of the logs returned there should be another user_id which indicates the ID of the user/admin who made the request. **It’s important to note that the user_id will only be visible in the body if the change was made from the user’s Auth0 dashboard. If they made the change using the Management API and thus a token, the user_id will not appear in the body of the logs. **
Resources 
:
Related FAQ: