When looking at a User Activity report in the Admin Console, an administrator may see a Created New User action with a blank value in the User column and "User: " in the Details column:
This is expected behavior in certain configurations.
Root Cause
An admin will see this behavior in the User Activity reports when a user account is created through Single Sign On "On-the-Fly" Registration or when a collaboration invite creates a new managed user. This is the case because when the "create user" action is taken, it is technically taken by the user whose account it being created. When the action is taken, that user account does not exist yet, so we cannot track the user as the person taking the action.
admin_swarm_kb