Check Which Doors Are Still Open
An old tablet, a borrowed laptop, and a browser you stopped using can leave a surprisingly long account history. Some entries represent access that still works. Others record a session that already ended. A useful review separates those cases before you start pressing removal buttons.
Begin with one important personal account, such as your primary email account. Identify the devices and sessions you still need, close obsolete access, and confirm the result. The goal is an access list you understand, rather than an empty screen achieved by signing yourself out of everything.
For a work or school account, follow your organization's process. Administrators may manage session policies and see activity unavailable to you. This guide concerns accounts you are authorized to manage yourself.
Start From a Trusted Device and Account
Open the provider through its usual installed app, a verified bookmark, or an address you already know. Navigate to account security and look for signed-in devices, sessions, or recent activity. Use help reached through the provider when the labels differ.
Check the selected account before changing anything. A browser can hold several personal and work identities, and a familiar device name may appear in more than one account. Record which service and account you are reviewing.
Before routine cleanup, confirm that you can sign in again and reach a supported recovery method. Keep multi-factor authentication enabled. If an unexpected message prompted the review, first verify the account security alert independently, rather than entering through the message's sign-out button.
Separate Devices, Sessions, and Activity
Four kinds of account information answer different questions:
- Device inventory: equipment associated with the account, sometimes for support, purchases, or device management.
- Session list: browser or app access that the provider lets you inspect and, where supported, end.
- Sign-in history: recorded attempts and events, including ones that failed or already ended.
- Connected apps: services granted account permissions, which may need separate revocation.
A device appearing in an inventory does not establish that every browser on it is currently authenticated. A failed sign-in event does not establish successful access. Read the status and available action before deciding what the entry means.
One computer can support several browser profiles and applications. Expect a review to involve more entries than the number of physical devices on your desk. The illustration represents that distinction; it is not a reproduction of an account dashboard.
Match Entries to Your Actual Use
Make a small private record of each entry's name, browser or app, displayed activity time, status, and your decision. Keep passwords, recovery codes, and session tokens out of it. Screenshots can reveal account details and locations, so store them privately if needed.
Compare several clues. Did you replace a phone, reinstall an app, use a private browser window, or sign in while traveling? A broad label such as a browser name is a starting point for investigation, not a reliable identity by itself.
Location estimates deserve the same caution. A mobile connection or VPN can produce an unexpected location. A matching city also does not prove that access belongs to you. Consider the event type, device, timing, and your own activity together.
Give each entry a decision: retain recognized access you still need, end recognized access you no longer need, or investigate something unexplained. Do not keep a questionable session simply because its name sounds familiar.
Use the Provider's Actual Sign-Out Controls
The following examples apply to personal accounts. Interfaces change, so confirm the control's current wording and read its confirmation before proceeding.
Google Accounts
In your Google Account, open Security & sign-in, then Your devices and Manage all devices. Google shows current access alongside devices used in recent weeks; ended entries carry a Signed out indication.
Open individual details. Several sessions can belong to one device, including different browsers or private windows. Displayed times can reflect background synchronization rather than someone actively typing. Neither duplicates nor recent timestamps alone establish compromise.
For a device you no longer use, select the relevant entry and Sign out. Google warns that sessions sharing a device name can represent one or several devices. When ending access associated with that name, review and sign out all relevant sessions rather than assuming one selection covers them.
Microsoft Personal Accounts
Keep the Microsoft account's Devices page separate from its security controls. Equipment registration and device associations serve purposes beyond login sessions. Removing an item there should not be your evidence that all account access ended.
Microsoft provides Sign out everywhere under Advanced security options in the account security dashboard. Its documented process can take up to 24 hours and excludes Xbox consoles, which require separate sign-out. Plan for interruption to your own apps and browsers, and read the current exceptions.
Apple Accounts
On an iPhone or iPad, open Settings, select your name, and inspect the device list. On a Mac, use System Settings and your name. Open a device's details before using Remove from Account, which Apple provides for remote sign-out.
Apple also provides a separate control for signing out all iCloud website browsers. Review browser access separately from the hardware list. For equipment you still own, follow Apple's on-device sign-out instructions when retiring it; Apple notes that a still-signed-in device can reappear.
Do not casually remove a missing phone as a housekeeping exercise. Follow the provider's lost-device process, including Find My where applicable, so you understand the consequences for recovery and device protection.
Close Obsolete Access and Confirm the Result
For routine cleanup, start with an entry you recognize and no longer need. Record the action, affected session, and time. If the control affects every device, prepare for that broader effect before confirming it.
Return to the account's security page and inspect the status. Allow the documented processing time. An entry marked signed out may remain as history; disappearance is not the only valid success condition.
If you still possess the retired device, test with a harmless action that requires fresh account access. A previously loaded page or cached document is weak evidence either way. Avoid deliberately sending sensitive information as a test, and do not reauthenticate the retired device merely to make its old session look active again.
Sign-out also cannot retrieve files or messages already downloaded. Before selling or giving away hardware, follow its separate preparation and erasure process. Ending a service session and clearing a device's stored data are different jobs.
Review Access That Sign-Out Does Not Explain
After the session review, audit connected apps and their permissions. A calendar integration or mail client may have separately authorized access. Read the provider's revocation controls rather than assuming a browser sign-out removed every permission.
Check recovery details and registered authentication methods as well. Changing a password is not a universal substitute for reviewing sessions: providers have different sign-out behavior and exceptions. Use the account's complete recovery procedure when access appears unauthorized.
If an unfamiliar successful sign-in, changed recovery detail, or unexplained account action appears, stop treating the exercise as routine tidying. Preserve a brief record, switch to a trusted device if necessary, and follow the provider's compromised-account process promptly. Documentation should not delay containment.
Keep a Baseline You Can Revisit
Finish with the review date, expected devices, retained sessions you can explain, actions taken, and any follow-up time. Avoid recording secrets. Revisit the list after replacing a device, borrowing a computer, ending a project, or recovering an account.
Also prepare for a lost phone without losing account access. Recovery is easier to plan while your normal devices still work. A completed review leaves you able to explain where access remains, how obsolete access was ended, and which checks still need attention.