Couple of ways...
- But if you use SCIM to create user... SCIM related logs will tell you when and how it created.
- If you use Cache Refresh to pull your user, CR related logs will tell you such info.
- If you use oxTrust to create user, you will get the creation info from oxTrust related logs.