User SA in XUserInserted/Updated

Is this related to your other post?

sa is the default SQL admin account.

Sorry I forgot I was answered before.

When this appears in the IDM, can we deduce that an operation was performed by a user directly in SQL Server?

You can deduce that an operation was executed by the Job Service (Script execution or Handle object operation). The sa in this context stands for System Administrator, which is the user used for Job Service operations, if a direct SQL connection is defined for Job Service operations.

If you are using TimeTrace you could detect if a change was done via direct SQL operations in the change log.