What is the implication if the event Type user.authentication.sso does not match in a System Log query?

If the event type user.authentication.sso does not match in a System Log query, it means that the filter applied to the query is set to show only specific events related to SSO (Single Sign-On) authentication. In this context, the logs generated by Okta will continue to be available; however, the query will only display entries that fit the specified criteria.

This means that if you're searching for SSO events specifically, and those events are not matched by the filter you’ve configured, then the query will naturally return results that do not include such events. Other types of authentication events or related logs may still be present but will not show up in the query results unless the filters are adjusted to include them. Thus, the absence of matching SSO events indicates that you are viewing a filtered subset of the logs based solely on the criteria set in your query.