How do I identify who controls a cloud account?¶

Identify account control by combining provider records with device, session and wider real-world evidence.

Evidential caution: that the registered account holder must control every session.

What this means¶

Then examine active and historical sessions, token activity, device identifiers, applications, IP addresses and account changes.

A person may own the account but not control it at the relevant time. An attacker may use a stolen session while the legitimate user remains active.

A business account may be managed by several administrators. A shared mailbox or service account may be used by several systems or staff.

Device evidence can help show which browser profile, app, token or local file was linked to the session.

Communications, work records, physical access and known user behaviour may provide further corroboration.

State which account and session were involved, then explain the evidence linking that activity to the person or organisation believed to control it.

Where control changed over time, build a timeline of password resets, recovery changes, device enrolment, session creation and administrator actions rather than treating control as static.

Where the account is organisational, identify whether control sat with the individual user, an administrator, a shared team or an application. The same account can be subject to several layers of control at once.

What to check or do next¶

• Start with the stable account identifiers, tenant, recovery details, trusted devices and authentication methods.
• Look for evidence of shared use, compromise, delegation or automation.
• Do not rely only on the current settings. Recovery details, permissions and trusted devices may have changed after the event.
• Use precise language.