Access telemetry is the record of authentication and session activity, such as login attempts, successful sign-ins, session creation, and the devices or locations involved. It can come from identity providers, applications, VPNs, and other access systems.
During an investigation, defenders use this data to test whether an account or system was accessed, distinguish suspicious activity from routine use, and establish a timeline. Unexpected successful logins, unfamiliar devices, or unusual session patterns may indicate compromise, while failed attempts alone do not prove that an intrusion succeeded. Preserve and correlate these records with endpoint and network evidence; logging gaps or short retention periods can make findings harder to verify.