I have noticed that delegated user logins (i.e. when a managed package admin logs in via grant login access) show up in the downloaded setup audit trail, but do not show up in a SOQL query of the
SetupAuditTrailobject. This is referenced in the previous question here. Is there any documentation for this discrepancy? The linked question’s answer is unclear on this point, and I want to be able to document that using the query does not unintentionally exclude any other results.
This appears to be documented as a known issue. Summary:
Setup Audit Trail API not logging Login-As login event, only Login-As logout event
This is marked as having no fix, and unfortunately the workaround they suggest is getting the CSV via UI.