Skip to content

Review my own sign-in activity

Read what happened to your account recently: your sign-ins and refused sign-ins, the end of your sessions, and the changes to your authenticators, recovery codes and password, in every tenant.

Who can do it

Any person who signs in, for their own account. No role or permission is needed, and the activity is shown also when your credentials are managed by your organization's identity provider.

Only your own events are listed. An action an operator performed while acting in your tenant under support access is the operator's, and is not listed. While you act in a tenant under support access, the Security item is absent from the account menu and your activity is not read.

Before you start

The listing reaches your 1,000 most recent events, newest first, 20 to a page.

Steps

  1. Open the account menu in the header and select Security.
  2. Scroll to Recent security activity.
  3. Read each row:
    • When the event happened, in your display time zone;
    • what it Concerns: Sign-in, Session, Authenticator, Recovery or Password;
    • the Event, and, for a refusal, its error code;
    • the Outcome: Succeeded, Refused, Refused by policy or Result withheld;
    • the Tenant, or No tenant;
    • where it came From: the client address and browser, or Not recorded.
  4. When there is more than one page, use Older and Newer to move between them.

What you see when it worked

The rows of your own events, newest first. Result withheld means the action was performed but its result was withheld because its record could not be confirmed. Refused by policy means a rule refused it, for example the removal of an authenticator you still need.

If you see a sign-in you do not recognise, end that session under Where you are signed in and change your password or add a passkey.

If it fails

What you see Cause What to do
"Your security activity could not be read" The audit service did not answer Retry from the message, or come back later
"No security activity yet" No event of your account has been recorded yet Nothing to do

Without the console

Surface How
API GET /api/v3/audit/account/security-activity (operation listAccountSecurityActivity)