Activity

The events from the last 90 days that involve your account, what the list shows and how to read it.

On this page

The Activity tab of Your data is a record of what has happened on your account in the last 90 days, newest first. Use it to answer "was that me?": a sign-in you do not remember, a password change, an app that was allowed, a token that was created.

Activity is wider than the security feed. The feed picks out security events and flags the ones to review. Activity lists everything the platform recorded about your account, in plain language, with no filtering by importance.

The Activity table#

The table is titled Account activity. Its columns are:

Column	What it shows
Time	When the event happened, in your time zone.
Event	A plain-language label, for example Signed in with a passkey, Password changed or Access token created.
Involvement	How the event relates to you. See below.
IP address	The network address of the request, when the event was one you made.

The page says: "Security-relevant events on your account from the last 90 days, newest first." An account with no events says No activity in the last 90 days and that sign-ins and changes to your account appear here.

The Activity page: a table of the security-relevant events of the account from the last 90 days, newest first, with when each happened, what it was and who was involved. — Activity: what happened on the account, newest first. Sample data./account/activity

What the Involvement column says#

Value	Meaning
You	You did it, for example signing in or changing your password.
About your account	Someone or something else did it to your account, for example another account being merged into yours.
An administrator, acting as you	An administrator performed the action on your account, as you. There is no address for these rows.

What is listed#

Events include, in groups:

Signing in and out. A sign-in with a password, passkey, authenticator code, emailed link or linked account, failed attempts, step-up confirmations, the emailed code used when a passkey is lost (Lost-passkey code emailed and Lost-passkey code accepted), new sessions, sessions ended and signing out.
Sign-in methods. Passwords, passkeys, authenticator apps, recovery codes, email addresses and linked accounts added, changed or removed.
Access tokens and devices. Tokens created, renamed, used, refused or revoked, and device trust changes and removals.
Apps. An app you approved or withdrew, access granted or refreshed, and apps told that you signed out.
Your account and organizations. Profile updates, joining or leaving an organization, accepting or declining an invitation (Invitation declined), account recovery, data exports and deactivation, and organization events that concern you: Workspace upgraded to an organization, Rejoined an organization, Organization membership restored, Guest access ended, Organization access blocked until you sign in with the organization's single sign-on, Single sign-on verified for an organization, Single sign-on sign-in failed, and Account claimed by an organization or Account released by an organization. Which of these appear depends on whether the platform recorded you as the person involved.

Each label is written from your point of view and never names another person. Labels appear in the language of the page; the ones quoted here are the English wording.

The list shows events recorded under your account. Events that are only mentioned inside other records are not surfaced.

Paging and the 90 day window#

The first page shows up to 50 events. At the bottom the table says how many events are shown, for example 50 events shown, with a Load more button. When you have reached the end it says That is everything from the last 90 days. If loading fails the page says Could not load more events. Try again.

Events older than 90 days are not shown on this page. How long the platform keeps them is on Retention and deletion.

How to use it#

Open Your data in the account navigation. Activity is the first tab.
Scan the Event column for something you did not do, and look at Time and IP address.
If something is not yours, end the session on Sessions, then review how you sign in.

What can go wrong#

What you see	What it means
No activity in the last 90 days	There was none in the window, or the account is new.
An address you do not know	It is the address the request came from. It can be a mobile network or a VPN. Compare it with your sessions.
A row with An administrator, acting as you	An administrator performed that action on your account. If you did not expect it, contact the security contact on Security practices.
A missing event you expected	It may be older than 90 days, or it is not recorded under your account.