diff --git a/src/Model/Behavior/AuthKeycloakBehavior.php b/src/Model/Behavior/AuthKeycloakBehavior.php
index 12bb3e2..7cbb5ca 100644
--- a/src/Model/Behavior/AuthKeycloakBehavior.php
+++ b/src/Model/Behavior/AuthKeycloakBehavior.php
@@ -137,6 +137,30 @@ class AuthKeycloakBehavior extends Behavior
                 ]
             ]
         );
+        $logChange = [
+            'username' => $data['username'],
+            'individual_id' => $data['individual_id'],
+            'role_id' => $data['role_id']
+        ];
+        if (!$response->isOk()) {
+            $logChange['error_code'] = $response->getStatusCode();
+            $logChange['error_body'] = $response->getStringBody();
+            $this->_table->auditLogs()->insert([
+                'request_action' => 'enrollUser',
+                'model' => 'User',
+                'model_id' => 0,
+                'model_title' => __('Failed Keycloak enrollment for user {0}', $data['username']),
+                'changed' => $logChange
+            ]);
+        } else {
+            $this->_table->auditLogs()->insert([
+                'request_action' => 'enrollUser',
+                'model' => 'User',
+                'model_id' => 0,
+                'model_title' => __('Successful Keycloak enrollment for user {0}', $data['username']),
+                'changed' => $logChange
+            ]);
+        }
         return true;
     }
 
diff --git a/src/Model/Table/SettingProviders/CerebrateSettingsProvider.php b/src/Model/Table/SettingProviders/CerebrateSettingsProvider.php
index 5ed9f3b..9cf755d 100644
--- a/src/Model/Table/SettingProviders/CerebrateSettingsProvider.php
+++ b/src/Model/Table/SettingProviders/CerebrateSettingsProvider.php
@@ -398,7 +398,7 @@ class CerebrateSettingValidator extends SettingValidator
             $foundEnabledAuth = __('Cannot make change - this would disable every possible authentication method.');
             foreach ($providers as $provider) {
                 if ($provider !== $setting['authentication_type']) {
-                    if (Configure::read($provider . '.enable')) {
+                    if (Configure::read($provider . '.enabled')) {
                         $foundEnabledAuth = true;
                     }
                 }