Sessions and login history
See the devices signed in to your account, sign them out, and review every sign-in and security change.
Two lists under SettingsSecurity show how your account is being used. Where you’re signed in lists every device with a live session, and lets you sign any of them out. Login history records every sign-in attempt and every important change to your account. Together they tell you whether anyone else is using your account, and let you stop them.
Who can use it#
Everyone, for their own account. No permission is needed, and nobody else can read your login history, including administrators. An administrator who can remove members can also sign a member out of all their devices from SettingsMembers.
Where you’re signed in#
Each row shows:
- the browser and device, for example Chrome on macOS (or Unrecognised device);
- a This device badge on the session you are using now;
- a partial network address and when the session was last used.
Sign out a device#
Find the device
Look for a device you no longer use or don’t recognize.
Choose Sign out on its row
That session stops working immediately; anyone using it has to sign in again. Signing out This device signs you out here too.
Sign out every other device#
Choose Sign out other devices (shown when you have more than one session). Every session except this one ends, and a message tells you how many were signed out.
Sessions cover every organization
You have one account and one set of sessions, not one per organization. Signing a device out ends its access to every organization you belong to.
Sessions also end automatically when:
- you change your password (every other device);
- you reset your password (every device, including this one);
- an administrator signs you out from the Members list.
Login history#
The table lists events newest first. Choose Show older to load more. Entries are kept for 400 days.
| Column | Shows |
|---|---|
| When | Date and time of the event |
| What | What happened. by an administrator means someone else did it, for example changed your role. |
| Device | The browser and device, as reported by the browser |
| From | An approximate location, or a partial network address, never a full one |
| Result | OK, Failed, New device or Suspicious |
Events you’ll see#
- Signed in
- A successful sign-in.
- Sign-in failed
- Someone entered your address with a wrong password or code.
- Signed in from a new device
- A successful sign-in from a browser and device this account hadn’t used before. A browser update doesn’t count.
- Suspicious sign-in
- A credential your device uses to stay signed in was used twice, once by something else. Everything from that sign-in was signed out as a precaution.
- Signed out
- A session was ended.
- Two-factor turned on / off
- Two-factor authentication was enabled or disabled.
- Passkey added / removed
- A passkey was registered or removed.
- Password changed / Password reset
- Your password was changed while signed in, or reset from an email link.
- Email verified
- Your email address was confirmed.
- API key created / revoked
- An API key belonging to your account was created or revoked.
- Your role changed / Role permissions changed
- Your role, or the permissions of your role, changed.
- Single sign-on changed
- Your organization’s single sign-on settings changed.
If something looks wrong#
Sign out the devices you don’t recognize
Or choose Sign out other devices.
Change your password
See Passwords and email.
Add a second factor
Turn on two-factor authentication or add a passkey.
A failed sign-in means someone had your address but not your password. A successful one you don’t recognize means they had both.
Limitations#
- Device and browser names come from what the browser says about itself. A tool pretending to be Chrome is listed as Chrome.
- A city-level location only appears if your UnitX installation has a location provider; otherwise the From column shows a partial network address.
- API keys, service accounts and connected apps aren’t sessions and aren’t listed. Revoke them where they were created.
Frequently asked questions#
I signed a device out and it’s still in the list.
Reload the page. If the row is still there, a new session was opened; if that wasn’t you, someone has your password. Change it and turn on two-factor authentication.
Can an administrator see my login history?
No. The organization’s audit trail records what people do inside the organization, not where they sign in from.
Still stuck? Search the docs with ⌘K, open Help inside UnitX, or contact support.