Table of contents
Google Logins
Login events give a reliable signal of when a user authenticates with their Google account. These come directly from Google Workspace audit logs and reflect real user-driven authentication.
For connection steps, see Connecting Google Workspace.
What WorkSights Receives
WorkSights captures authentication events: successful logins, failed login attempts, login challenges, verifications, and logout events, along with network and region information. When Google flags a login as suspicious, that flag is included. Passwords, tokens, and credential data are never received.
Login is a system-level signal that is always on and cannot be toggled per user.
How Login Activity Appears
Login events appear as short entries on the timeline, marking when a user authenticated. They help clarify when a working session started, when an action required re-authentication, and whether work happened across multiple devices or locations.
Troubleshooting
Login activity is not appearing
Confirm the domain is connected and the affected user is mapped in WorkSights. Login events reflect user-driven authentication, so background system activity does not generate entries.
Activity appears late
This is expected. Login activity is processed in batches roughly every 20 minutes.