After the RM Unify v4.28 release in August 2022, your Google audit log shows many 'Password change' events on Google user accounts linked to an RM Unify account, where the Actor (instigator) of the event is the super admin account used to federate your RM Unify establishment to Google Workspace.

The timestamp of the Last Logged On attribute of an affected user's RM Unify account is the same or more recent than the 'Password change' event reported in the Google audit log.

The RM Unify User audit log does not report a recent 'Password change' event for the affected user.

This release applied additional security improvements to RM Unify. When a user first signs into RM Unify after the release, we apply additional security to their RM Unify account and this triggers a sync of data from RM Unify to all the connected apps, including Google Workspace. The Google audit log displays this update as a 'Password change' event, even though the user's RM Unify password has not changed.

Important note: If a user reports their RM Unify password or Google password has been changed (and unexpectedly), please investigate this separately as a security incident as it is unlikely to have been caused by the RM Unify release.