Use the security centre

See MFA coverage, unusual sign-ins, live sessions and recent sensitive changes in one place, and end sessions when needed.

For: Workspace admins

Steps

Open Settings → Security centre. The top row shows multi-factor coverage, passkey adoption, open login anomalies and live sessions.
Under Login anomalies, review each finding: a new country or network, impossible travel between two sign-ins, a burst of failed attempts, an admin signing in from a new device, or an address the IP allowlist blocked.
Select Acknowledge once you have checked a finding with the person.
Open Sessions & devices to see everyone signed in. End one session, sign one person out everywhere in this workspace, or select Sign out everyone (your own session stays).
Under Remembered devices, revoke a device to make it ask for the second factor again.
Check Recent sensitive events for security, role, single sign-on, API key, reveal and export changes.

Anomalies come from fixed rules, not AI. The person concerned is told by email and in the app; admins are also told about admin accounts.
Locations come from our hosting provider's own network data: no third-party lookups. A VPN or mobile network can make a sign-in look like it came from elsewhere.
You can also see one person's sessions and devices on their page in Settings → Users.

Still need help? Contact support

See MFA coverage, unusual sign-ins, live sessions and recent sensitive changes in one place, and end sessions when needed.

For: Workspace admins

Open Settings → Security centre. The top row shows multi-factor coverage, passkey adoption, open login anomalies and live sessions.
Under Login anomalies, review each finding: a new country or network, impossible travel between two sign-ins, a burst of failed attempts, an admin signing in from a new device, or an address the IP allowlist blocked.
Select Acknowledge once you have checked a finding with the person.
Open Sessions & devices to see everyone signed in. End one session, sign one person out everywhere in this workspace, or select Sign out everyone (your own session stays).
Under Remembered devices, revoke a device to make it ask for the second factor again.
Check Recent sensitive events for security, role, single sign-on, API key, reveal and export changes.

Anomalies come from fixed rules, not AI. The person concerned is told by email and in the app; admins are also told about admin accounts.
Locations come from our hosting provider's own network data: no third-party lookups. A VPN or mobile network can make a sign-in look like it came from elsewhere.
You can also see one person's sessions and devices on their page in Settings → Users.

Still need help? Contact support