There should be audit report for users activity in the web administrator console for RSA 2FA,
For the time being the only report you can generate is "All synchronized users" Report, from this report you can get all the users and see their registered devices type and when it was registered, also if any emergency token was assigned .
how ever there should be a way to get ADUIT reports on who generated the emeergency token or who logged in to the cloud console and make any change and users activity with full necessary details..
