Cloud Services · CLD-012

Can a cloud account be accessed from several devices?¶

Yes. A cloud account can usually be accessed from several devices, often at the same time.

A user may sign in from a phone, laptop, tablet, work computer or web browser. Applications may also maintain background access after the user has stopped actively using them.

What this means in practice¶

The device may be one of several authorised devices. Another device may have remained signed in. A stolen session may be active elsewhere. A linked application or service may access the account without the user opening the main cloud application.

Device names can be changed. Browsers may present similar information. Software updates can alter fingerprints. VPNs, proxies and mobile networks can change the connection information recorded by the provider.

Where an account is actively compromised, changes should be coordinated carefully. Password resets or session revocation may preserve security but can also alter the evidential environment.

What this does not show on its own¶

The dangerous assumption is that activity recorded against the account must have come from the device you have seized or examined.

Provider records may contain device names, operating-system details, browser information, application identifiers, IP addresses, session identifiers and authentication events. These can help distinguish access routes, but they do not always uniquely identify a physical device.

What to do next¶

Compare provider records with the devices available to you. Look for matching applications, account identifiers, browser history, synchronisation activity, notifications and local timestamps. Check whether the device was capable of producing the event at the relevant time.

Do not assume that removing or securing one device ends the access. Other sessions, trusted devices, refresh tokens or delegated applications may remain active.