Check who has access, and who actually signs in

This article is for anyone who needs to check who can get into your workspace, and who has actually been using it — useful for audits, offboarding, or a routine security check.

#Overview

• Access shows who can reach your workspace right now — their role, whether two-factor is turned on, and when they last signed in.
• Sign-ins shows who actually signed in over a period of time you choose, and how often.
• They're kept separate on purpose: one describes the present, the other describes history.

#Check who has access right now

1. Open Access.
2. Look at the top of the list first — people without two-factor turned on are always listed there, ahead of everyone else, since that's usually what a review is looking for.
3. If your company signs people in through an identity provider (like Okta, Microsoft Entra ID or Google Workspace), those people will show Signs in with and the provider's name instead of Off. This means the provider handles two-factor for them, so they're not flagged as missing it — unless they can still also sign in with a password, in which case the warning stays, with the provider named beside it.
4. Scroll down to see pending invitations. Anyone who hasn't accepted yet is listed here, with expired invitations marked. Check this list if someone left the company before accepting their invite.
5. If someone shows "Last signed in: never," that's accurate — it means there's no record of them ever signing in.

NoteRoles are per workspace. Someone can be an owner in one workspace and a viewer in another — each report only shows their role for the workspace you're currently in.

#Check who signed in over a period

1. Open Sign-ins.
2. Choose a month, a quarter or a year to review.
3. Check the top of the list — people with zero sign-ins for the period are listed first. That's usually the most important thing this report tells you: an unused account for a whole quarter is either a missed offboarding or a licence you're paying for with nothing in return.
4. Look at "Days active" rather than total sign-in count when judging real usage — eight sign-ins in one morning is one day of work, not eight.

TipIf you pick a period before sign-in history started being kept, the report will tell you the earliest date it can report from, instead of showing a false month of zeroes.

#Export a report for an audit

1. Open either Access or Sign-ins.
2. Select Export CSV to download the rows exactly as shown — useful for attaching to an ISO 27001 or SOC 2 access review ticket.
3. To share the same view with a colleague, copy the address bar link — it opens the same report with the same period.
4. Select Print to save the report as a PDF, with the period and any filters restated on the page.

NoteEvery export is recorded in your audit log, so there's a trail of who pulled the evidence and when.

#Good to know

• Removing someone from the workspace removes them from Access immediately, but they'll still appear in Sign-ins for any period when they did sign in — that's history, and it doesn't get rewritten.
• Sign-in records are summarised per person per day and kept separately from the security log (which clears out after a few weeks), so "last signed in" keeps working correctly even for old accounts.