The usual account settings page tells you your email address and offers to change your password. Everything interesting — who has your data, what they receive, what happened to your account while you were not looking — is either absent or spread across pages that assume you already know what you are looking for.
This is a tour of where those things live and, more usefully, how to read them.
The audit trail: what happened
/account/audit is a record of actions taken on your account: sign-ins, factor changes, token issuance, consent grants, administrative actions. It is the same underlying event stream an administrator sees, filtered to you.
How to read it. Do not scan for entries that look alarming — most attacks generate entries that look mundane. Scan for entries you cannot place. A successful sign-in from a city you have visited is unremarkable; a successful sign-in at 04:00 from a device type you do not own is worth ten minutes even though nothing about the entry says "warning".
The entries worth the most attention are the boring ones in the second column: a factor being added, a recovery method changing, a new application being authorized. An attacker with a session does those things early, because they are what makes the access durable.
Consent history: what you agreed to, and when
Every authorization you have granted, including the ones you have since revoked, with timestamps. The value of keeping revoked entries is that a grant you do not remember making is a fact about the past that a current-state list would have quietly erased.
Per-app claim transparency: what each app actually receives
On Authorized Apps, each application shows the claims it is handed — not the scope names it requested, but the fields that go across. The distinction matters, because scope names are marketing and claims are data. profile tells you nothing; a list containing your name, locale and picture tells you what you have agreed to.
Worth knowing while you read it: the identifier each application receives is pairwise. Every app gets a different one, none of them is your real account ID, and two applications comparing notes cannot determine they are looking at the same person.
Security assessment: what to fix, in order
A dashboard that scores the account and, more importantly, ranks what to do about it. The ranking is the product. A list of eleven things you could improve is a list nobody acts on; the first item is the one worth reading.
We removed items from this page that told you to do things you could not do from where you were standing. Advice you cannot act on is not advice, it is a source of guilt, and it teaches people to ignore the page.
Security alerts and required actions: what needs you
Two pages, deliberately separate. Alerts are things that happened which you may want to know about — a sign-in from a new device, a factor changed, an unusual location. Required actions are things that will block you until you deal with them.
Keeping them apart means the second list is almost always empty, which is what makes it meaningful when it is not. A single merged list of "notifications" trains you to dismiss the lot.
Privacy: residency and retention
/account/privacy states where data is held and how long each category is kept. This is the page most products replace with a link to a policy document, and the two are not equivalent: a policy tells you what a company may do, while this tells you what is true of your account.
Custom attributes and groups
If your account belongs to an organization, it may carry attributes an administrator set and group memberships that determine access. Both are visible to you. Being able to see the basis on which you were granted or refused something is a reasonable thing to want, and it is usually missing.
A short routine
- Connected apps. Revoke anything you do not currently use. This is the single highest-value minute available to you.
- Sessions and devices. Sign out anything you do not recognise, then anything you no longer own.
- Audit trail. Read the last thirty days, looking for entries you cannot place rather than entries that look scary.
- Security assessment. Do the first item. Ignore the rest until next time.
Fifteen minutes, twice a year, and the first item on that list does most of the work.