Sign-In Activity shows how your people sign in: which ways they use, why some attempts fail, how many have set up stronger ways in, and any sign-in that looked unusual.
Open Settings, then Security, and choose Sign-In Activity. You need the Manage Sign-In Methods permission, the same one that opens Identity & Sign-In.
Sign-In Activity
The page reads from top to bottom: the period and person you are looking at, four totals, a chart of how people signed in beside how many use the stronger ways in, the reasons sign-ins failed beside the list of unusual sign-ins, and finally every single attempt. Nothing on this page changes how anyone signs in; it only shows what happened.
Whose Sign-Ins You See
You see your own sign-ins and those of everyone who reports to you, directly or further down, as set by the Manager field on each member's profile. The note at the top of the page says so: "You see sign-ins for yourself and the people who report to you."
The owner of the organization sees everyone, and the note then reads "You see sign-ins for everyone in your organization." Failed attempts that name no account at all (for example a mistyped email address) are only shown to that whole-organization view, because they belong to nobody's team.
Choose A Period And A Person
- Period: the last 7, 30, 90 or 180 Days, today included. 30 days is where it starts.
- Person: Everyone, or one person. The list only offers people whose sign-ins you can see in that period; type part of a name to find someone. Press the × beside their name to show everyone again.
Every part of the page, including the export, follows the period and person you pick. Refresh reads everything again.
The Totals
- Sign-Ins: the times someone got in.
- Failed Attempts: the times someone was turned away.
- People Who Signed In: how many different people signed in at least once.
- Unusual Sign-Ins: the ones listed under Unusual Sign-Ins below.
How People Signed In
One bar for each day (for 90 or 180 days, one bar for each week), split by the way the person proved who they were: Password, Passkey, Other Account (such as Google or Microsoft), Single Sign-On, Email Code, KamoMobile or QR Code. Passwords wear your organization's own colour. Point at a bar to see every number for that day.
Show As A Table turns the chart into the same numbers in rows, one per day or week, with a total.
- Example: after you turn on passkeys, watch the passkey part of each bar grow while the password part shrinks.
Why Sign-Ins Failed
The reasons people were turned away, most common first, each with a short explanation, how many times it happened and when it last did. Typical reasons are a wrong password, a wrong two-step code, an address no account uses, an account locked after too many tries, or a sign-in from a place your access rules block.
- Example: many Wrong password attempts for one person in a short time can mean they've forgotten it, or that someone is guessing. Check Every Sign-In filtered to that person.
Stronger Ways In
How many of the people you can see have each stronger way in set up, as a share and as a count ("6 of 14"):
- Passkeys: a fingerprint, face or device PIN instead of a password.
- Two-Step Verification: a second check after the first, such as a code from an app.
- Other Accounts: an account they already have, such as Google or Microsoft.
- Single Sign-On: your organization's own sign-in service.
Passkeys and two-step verification make a stolen password useless on its own, so these are the numbers worth growing.
Unusual Sign-Ins
A list of sign-ins that looked unusual, newest first. Each shows who it was, when, how they signed in, roughly where, on what device, why it looked unusual, a score, and what happened.
This list is Watch Only unless you turn on Ask For A Second Step When Sign-In Looks Unusual on the Sign-In Methods tab: nobody is stopped, it is a list to look over. The Ask For A Second Step button takes you to that switch.
What happened, for each one:
- Watched: listed here only; the sign-in went ahead as normal.
- Would Have Asked: the switch is on, but this person has no second step set up, so they signed in as normal.
- Asked For A Second Step: the person was asked for their second step before getting in.
What Makes A Sign-In Unusual
- New Device: a browser or phone this person had never signed in on before (never counted for their very first device).
- New Country: a country this person hadn't signed in from in the last 90 days.
- Impossible Travel: too far from their previous sign-in to have got there in the time between, for example London and then Sydney an hour later.
Each sign adds to a score out of 100 (New Device 30, New Country 40, Impossible Travel 60). A score of 50 or more counts as unusual. The person also gets a "New sign-in to your account" notification the first time a new device is used, so they can secure their account if it wasn't them.
Every Sign-In
Every attempt, newest first, 25 at a time. Choose All, Signed In, Failed or Unusual above the list. Each row shows when, who (or "No matching account" when the address named nobody), whether it worked and, if not, why, how they signed in, roughly where, and the device. Point at the place to see the network address. Use the arrows at the bottom to move between pages.
Export
Export downloads what you are looking at as a spreadsheet file (CSV): the same period, person and filter, up to 10,000 rows. Open it in Excel, Numbers or Google Sheets.