KB-2438 How to distinguish between SSO and non-SSO login attempts

Purpose

This article outlines the steps on how to distinguish between SSO (SAML, LDAP, etc.) and non-SSO login attempts.

Prerequisite

To view the login audit details, the user running through the steps below must have access to System Logs.

Instructions

1. The login-audit.csv log has a Source column that indicates the authentication source (for example, Portal, Web API, etc.). SSO sign-ins (SAML, LDAP, etc.) appear under Portal.
2. The MFA Authentication column, when true, indicates that the user logged in using multi-factor authentication. This value is false in any of the following situations:
   - Username/password authentication failed.
   - The user logged in with an externally managed method like SSO or LDAP.
   - MFA is not enabled for the user.
3. When a user tries and fails to sign in with SAML authentication, an event is recorded in the saml_failed_logins.csv file (available in the <APPIAN_HOME>/logs/audit directory). For more information on the saml_failed_logins.csv file, please see the documentation linked here.

Reference the following Appian documentation for additional context on login auditing and authentication methods:

• Logins
• External Authentication Versus Local Authentication

Affected Versions

This article applies to all versions of Appian.

Last Reviewed: November 2026.