13.4 Cloud Account Settings, History, and Data Export
Active Sessions Are Token Issuance Records
The "your devices and sessions" page is a registry of credentials, not a webcam view. Each row is an issued refresh-token grant tied to a client, IP, and approximate geolocation derived from that IP. "Sign out everywhere" works by invalidating those grants at the identity provider, which is why it is also your best emergency lever. Review the map monthly: an unfamiliar browser, an old laptop you sold, or a city you never visited is actionable intelligence, and you should terminate anything you cannot name.
Reading the Audit Log Like an Analyst
The raw event feed records successful and failed sign-ins, second-factor events, app-authorization grants, password and recovery changes, and permission edits on shared items. Watch for patterns rather than single rows: a failed-login burst followed by success suggests password guessing; a new connected-app grant you did not initiate is an OAuth foothold; a recovery-contact change is almost always the prelude to permanent lockout. Retention windows are short -- often weeks, not years -- so export the feed periodically if you need a durable trail.
Recovery Paths Are Attack Surface Too
Backup emails, phone numbers, and one-time codes are the attacker's preferred route around your password and second factor. Verify each contact is still live and itself secured -- a backup email with a weak password collapses your primary account's security to that weaker mailbox. Store recovery codes in an encrypted vault, not in the cloud account they protect, and test the recovery flow deliberately once a year so you know the procedure before you need it under duress.
Export to Understand the Blast Radius
Run the provider's data-export tool. The archive shows exactly what a token compromise or a subpoena would reveal: mail archives, contact graphs, location history, connected-app metadata. What surprises you in the export is your real exposure baseline; use it to decide what to delete, un-sync, or move under client-side encryption.
Architecture Diagram
Key Takeaways
- Session rows are issued refresh-token grants with client and IP metadata; "sign out everywhere" revokes them at the identity provider.
- Read audit logs as patterns: failed-then-success bursts, unknown app grants, and recovery changes are the highest-signal events.
- Audit-log retention is short; export the feed if you need evidence beyond the window.
- Recovery contacts bypass your second factor -- secure each contact as an account of its own and keep codes offline.
- Run a data export to see your real exposure and drive deletion, un-sync, and encryption decisions.