What are trusted devices in a cloud account?¶
A trusted device is a device the cloud service recognises and treats as lower risk for future access.
The service may reduce repeated authentication checks, remember multi-factor approval or allow faster account recovery.
What this means in practice¶
Trust may be created because the user approved the device, selected a “remember this device” option or completed multi-factor authentication. But the device may later be shared, stolen, transferred or remotely controlled.
Device names can be changed. Similar devices can appear identical. A factory reset, software update or browser change may cause the same device to appear as a new one.
In a compromise investigation, check when trust was established, which account approved it and whether the device was known to the user. An attacker who controls an account may register a new trusted device to preserve access.
Where the account must be secured, trusted devices may need to be removed separately from changing the password.
What this does not show on its own¶
The dangerous assumption is that a trusted device is proven to belong to the named account holder.
A trusted-device record may contain a device name, operating system, browser, application, registration time, last use and security status. These details may help distinguish access routes, but they may not uniquely identify the physical device.
Trusted status can also affect the meaning of later login records. The user may not be prompted for multi-factor authentication because the device was already trusted. That does not mean the second factor was bypassed improperly.
What to do next¶
Compare provider records with device examination, asset records, browser history and wider evidence before attributing the trusted device to a person.
Key takeaway
A trusted device is a recognised access route, not proof of ownership or use, so establish when trust was created and which physical device it represents.