What is cloud authentication?¶
Cloud authentication is the process a cloud service uses to decide whether an account, device, application or service should be allowed access.
It may involve a password, multi-factor authentication, a security key, a trusted device, single sign-on, a session token or another identity provider.
What this means in practice¶
A cloud service may accept an existing session without asking for the password again. A linked application may use an access token. A trusted device may complete part of the process automatically. An attacker may use stolen credentials, a stolen session or malicious delegated access.
In an organisational environment, authentication may be controlled outside the cloud service through single sign-on or federated identity. The organisation’s identity provider may therefore hold the most useful login evidence.
What this may show¶
Authentication records can still be valuable. They may show the account used, time, IP address, device or browser information, authentication method, outcome and whether extra checks were required.
What this does not show on its own¶
The dangerous assumption is that successful authentication proves the named user personally entered valid credentials at that moment.
But different systems may record different stages of the same event. The identity provider may record a successful sign-in while the cloud application records only the resulting session. A failed password attempt may not appear in the application log at all.
What to do next¶
Ask how the service authenticates users, which system made the decision and whether the event involved a new login, a remembered session, token refresh or application access.
Do not describe every access event as a login unless the record actually shows a fresh authentication event.
Key takeaway
Authentication records show how access was accepted by the system, but you must establish which mechanism was used and whether it identifies a person, device, session or application.