Account trouble is almost never announced. It shows up as a sign-in nobody recognises, which is only useful if somebody is told.
A small business rarely has anyone whose job is security, so the practical protection is not a policy — it is being told when something changes and being able to act on it in one tap.
The history answers "has anything odd happened", the alerts answer it without being asked, and the device list is where you do something about it. Together they cover the realistic threat: a password shared once too often, or a session left open on a machine that has moved on.
When a new sign-in happens.
Where and when, against what you expect.
From the device list, if it is not yours.
Separate logins and roles, if it came from sharing.
Who can open the books, on which device, and what they are allowed to do once inside. Staff get accounts of their own rather than a shared password, and what each of them can reach is set screen by screen.
Most of it is set up once, early, and then only noticed when something changes — a new device signs in, a bill is cancelled, a role needs tightening.
per year
From Growth
The detail behind it and the action you take.
A sign-in that looks new — a device or a place the account has not been used from.
End that session from the device list, then look at why a credential was shared.
No. This is about access; the audit log is about what was changed once somebody was inside.
The realistic threat is a shared password, and it shows up as an unfamiliar sign-in.
