What should be recorded before revoking a session?¶

Before revoking a session, preserve enough information to identify it and explain why the action was taken.

Why this matters¶

The dangerous assumption is that the account will continue showing the same session details after revocation. Some services remove the entry immediately or replace it with a generic security event.

What to record and do¶

Record the device name, operating system, browser, application, location, IP address, last-active time, sign-in time and any provider-generated session ID.

Capture whether the session is marked current, trusted, managed, suspicious or recently active.

Record the wider account context, including username, tenant, workspace and the page URL.

Take a full-screen image before any selection, then closer images of the specific session.

Note what risk the session presents and what alternatives were considered.

Do not assume the displayed location or device name is exact. Provider labels can be approximate, user-defined or based on network information.

If the session is revoked, record the exact time, operator, authorisation and resulting confirmation.

Capture any change to the current session, linked devices, alerts or security history.

Preserve provider reference numbers or audit-event identifiers where visible.

If the platform displays only approximate location or time, preserve that wording exactly. Do not silently convert it into a precise address, person or event. Record whether the information appears provider-generated, user-defined or inferred.

Record the order in which sessions are displayed before any one is removed.

Preserve the screen before scrolling.

Operational takeaway¶

Capture every available session identifier and the decision rationale before revocation, because the session entry may disappear or lose detail afterwards.