Oct 21, 2026 · Andrius
Can't I just use the Okta System Log? What the log won't give you back
Every time I talk to another Okta admin about backups, I hear the same thing: "We don't need backups, we have the System Log."
I get it. The System Log is great. When something breaks, it's the first place I look. But after years of running Okta, I've learned the hard way that the log tells you what happened. It doesn't give you back what you lost.
What the System Log is good at
If someone deletes a group, changes a policy or edits a network zone, the log will usually tell you:
- what kind of change it was
- who made it (or which API token or app)
- when it happened
That's the starting point for every investigation, and nothing replaces it.
What it can't do
1. It doesn't hold the "before" picture
For most configuration changes, the log records that a policy or rule changed, not the full settings it had before. If someone edits a sign-on policy rule, you know it was touched. You don't get back the exact conditions, factors and session settings it had yesterday.
2. Deleted objects take their connections with them
Delete a group and you lose more than the group: its members, and its place in your rules and policies. Okta even sets affected rules to INACTIVE (we tested this). Rebuilding means piecing together memberships and references from scattered log events, as long as they're still within your log retention window.
3. A recreated object isn't the same object
Rebuild a group with the same name and Okta gives it a new ID. Anything that pointed at the old one won't point at the new one.
4. It doesn't tell you what's safe to put back
The log can't answer the questions that matter during a fix: If I put this back, what else changes? Is something else depending on it? Will I overwrite something a colleague fixed this morning?
What a configuration backup adds
That's the gap we built DRIUS to fill. DRIUS takes regular snapshots of your Okta configuration, so when something changes you have the before picture, not just the fact that something happened.
And before anything is written back, you see a review of exactly what will change: what gets created or updated, what's in Okta now next to what's in the backup, plain-English risk warnings, and the order things need to happen in. Nothing changes in Okta until you approve it. (More on how DRIUS restores.)
Use both
This isn't logs vs. backups. You need both:
- The System Log tells you who changed what, and when.
- A configuration backup lets you see exactly what it looked like before, and put it back safely.
If you've ever spent a Friday afternoon rebuilding a group from screenshots and memory, you already know which one you were missing.
DRIUS is in early access for Okta admins. If you'd like to try it on a sandbox or preview org, get in touch at drius.io.