What is a cloud session?¶
A cloud session is the continuing relationship between a user, device, application or browser and a cloud service after access has been accepted.
It allows activity to continue without requiring the user to authenticate again for every action.
What this means in practice¶
A session may remain active for minutes, days or longer. It may survive closing the browser, restarting the device or changing networks. Some sessions continue after a password change unless they are specifically revoked.
Where compromise is suspected, identify all active sessions and their creation times. A session created before a password reset may explain later activity.
What this may show¶
A session can be represented by cookies, tokens or other identifiers. The provider may record when it was created, refreshed, used, expired or revoked.
Session evidence can help connect several events. A login, file access and sharing action may all relate to the same session even though only the first event involved authentication.
Be aware that providers may rotate or refresh session identifiers. Two identifiers may still relate to the same continuing access chain.
What this does not show on its own¶
The dangerous assumption is that every cloud event begins with a fresh login.
But a session does not identify a person by itself. The device may be shared. The session may be stolen. An attacker may remotely control the device. An application may act in the background.
What to do next¶
Record session identifiers where available and compare them across logs. Check the account, device or browser information, IP addresses, authentication method and timing.
Do not confuse session termination with deletion of the underlying evidence. Ending access may stop future use, but the provider and device may still retain records of what happened.
Key takeaway
A cloud session links continuing activity after authentication, so use session records to connect events while avoiding the assumption that each event represents a new login or a known person.