Sandra was running late for a presentation. She logged into her work account from the conference room computer, clicked through the MFA prompt and checked "Remember this device" to save time. It worked. She finished her meeting and rushed back to her desk.
Three weeks later, IT flagged unusual activity on her account. Someone had accessed her email from that same conference room computer. After hours. On a Saturday.
Sandra had no idea the session was still active. She never logged out. The computer sat in a shared space, used by staff, visitors and after-hours cleaning crew. The open session was all anyone needed.
Sandra checked "Remember this device" on a shared computer and never logged out. That checkbox told the system to skip future login checks on that machine. Her session stayed active long after she left the room. Anyone who sat down at that computer could access her account without a password.
Shared computers are used by many people. A remembered session is an open door. Anyone who sits down can read your email, access files, send messages as you or reset account credentials. This puts your work data, your reputation and your organization at risk. The same risk applies at home if you share a computer with family members.
Never check "Remember this device" on a shared, public, or borrowed computer.
Always log out completely when you finish a session on any shared device. Closing the browser tab is not the same as logging out.
On your personal devices at home, "Remember this device" is safer, but only if you use a screen lock and do not share the device.
After using a shared computer, go to your account security settings and review active sessions. Sign out of any sessions you do not recognize.
If you think you left a session open, contact IT right away. Do not wait to see what happens.
Open your Microsoft 365 account settings, go to Security and check your active sign-in sessions. If you see a device or location you do not recognize, sign out of it immediately and notify IT.
Never use "Remember this device" on shared or public computers.
Always log out fully after using a shared device.
Review your active sessions regularly in your account security settings.
Use a screen lock on personal devices where saved sessions are stored.
Report any session or login activity you do not recognize.
Always log out on shared devices. Every time. No exceptions. Closing the tab does not count.