User Login Activity

User login activity lists the sign-in history of the members in the current space, including where and how each session was started.

Open Account Center, then select User Login Activity.

The list opens with the last seven days and 20 rows per page.

Before You Use The List

• Records come from sign-in events of the space. A member must sign in once before anything appears
• Operating system, browser, and device type are parsed from the client user agent, so unusual clients can be reported in a generic way
• Use the page for auditing: narrow the range first, then export a copy before the range moves on

Review A Suspicious Sign-in

1. Narrow the time range to the period you are investigating
2. Search for the member, the email address, the IP address, or the device information
3. Read the row: IP address, operating system, browser, device type, and sign-in method show where and how the session was started
4. Sign-in methods other than password, such as single sign-on or an external identity provider, come from those sign-in paths; an unrecognized method is shown as -
5. Export the current filter to keep an audit copy before the range moves on

Verify That A Sign-in Is Recorded

1. Ask the member to sign in once from a known device
2. Set the time range to cover that sign-in and search for the member, the email, or the IP address
3. The new row must show the sign-in time, the device details, and the sign-in method; use the method to confirm whether the session came from a password, a verification code, single sign-on, or an external identity provider

Filters

Filter	Description
Time range	Date and time range of the sign-in. Common ranges are offered as presets, and the range is applied as soon as it changes
Search	Searches user, email, IP address, and device information. The keyword is applied when the search is submitted and cleared with the clear action; clearing resets to the first page

List Columns

Column	Description
Login time	Time the session was created
User	Member that signed in
IP address	Address the sign-in came from
Operating system	Operating system parsed from the client user agent
Browser	Browser parsed from the client user agent
Device type	Desktop device, mobile device, or tablet
Sign-in method	Authentication method used for the session

Sign-in methods are password, verification code, external identity provider, single sign-on, and space selection; an unrecognized method is shown as -.

Empty states distinguish a list without records from a search that matched nothing.

Actions

Action	Description
Refresh	Reloads the login records
Export	Exports every record that matches the current time range and keyword, not only the current page, to a spreadsheet named user-login-records-<timestamp>.xlsx with a Login records sheet

The export contains the columns above plus the member email and department, which are not shown in the table.