# How do I see sign-ins and sign out or block a user?

Source: https://help.didit.me/authentication/users-sessions-and-organizations
Updated: 2026-11-12

See every sign-in attempt and active session under Authentication, then sign a person out, block or unlock them, reset MFA, and manage organizations and agents.

Open **Authentication → Sign-ins** to see every sign-in attempt and every active session, and press **Revoke** to end a session. To act on one person, open their record under **Authentication → Users** and use the Authentication group: send a sign-in link, revoke all sessions, block or unblock sign-in, unlock, reset MFA or send a password reset.

This article covers the people who sign in to your own app with Didit Authentication. For turning Authentication on, see [add sign-in to your app](https://help.didit.me/authentication/add-sign-in-to-your-app).

## Users: one list for everyone

**Users** in the Authentication sidebar is the same people list you use for verifications. It is not a separate list. A person who signs in to your app and is verified with Didit is one record.

A person's record has an **Authentication** group with the sections **Sign-in** and **Agent access**. The actions are:

| Action | What it does | Who can do it |
|---|---|---|
| **Send a sign-in link** | Emails the person a link that signs them in. It works for 15 minutes. | Owner or Admin |
| **Revoke all sessions** | Ends every session now, on every device, agent sessions included. The person signs in again with any of their methods. | Members who can change Authentication |
| **Block sign-in** | The person can no longer sign in. Their sessions and agent access end now. | Members who can change Authentication |
| **Unblock** | Lets a blocked person sign in again. | Members who can change Authentication |
| **Unlock** | Lets a person back in after an account was locked by too many failed tries. | Members who can change Authentication |
| **Reset MFA** | Removes every second factor, passkeys included. The person gets an email saying who reset it and when, and every session and agent grant ends. They sign in with their password or a sign-in link and set up a new factor. | Owner or Admin |
| **Send password reset** | Emails the person a password reset. | Members who can change Authentication |

On **Send a sign-in link** and **Reset MFA**, a member who is not an Owner or Admin sees "Only an Owner or Admin can do this." The other actions need a role that can change Authentication: Developer, Admin or Owner by default. User bans are part of the Growth plan and up. See [pricing and active users](https://help.didit.me/authentication/pricing-and-active-users).

## Sign-ins: attempts and sessions

**Authentication → Sign-ins** has two tabs.

### Sign-in attempts

Each attempt has a state: **Success**, **Failed**, **Challenged** or **Blocked**. Challenged means the person was asked for an extra proof. Blocked means the attempt was refused, for example by bot protection or by your Blocklist.

- Filter by **State**, **Method** or **Risk**, or search by email, IP address or sign-in ID.
- Columns: State, Person, Method, Device, Location, Risk and Time.
- Press **Show older attempts** to look further back.

A failed attempt shows the reason in plain words, for example "Wrong email or password", "Wrong or expired code", "The account is locked after too many tries" or "The account is blocked".

### Active sessions

The **Active sessions** tab lists Person, Device, Location, Started, Last active and Ends. Press **Revoke** on a row to end that session at once. The person signs in again with any of their methods. To end every session of one person, use **Revoke all sessions** on their record.

### What you see without Scale

Keeping 30 days of sign-in logs, with every attempt, device and result searchable, is part of the Scale plan and up. Without it, your sign-ins show only in the totals on the Authentication overview.

## Organizations

**Organizations** is for business apps: your customers' own organizations inside your app, with members, roles, verified domains and single sign-on. Turn it on in **Authentication → Organizations** in a Live application. A person can belong to several organizations. Company logins (SAML and OIDC) for an organization need the Scale plan or higher.

Create an organization with **New organization**. Renaming or deleting an organization is not available yet, and the settings **People can create organizations** and **Personal accounts** read **Not available yet**.

## Agent access

**Agent access** lets people approve their own AI agents with scoped access that they, or your team, can revoke. In **Authentication → Agent access** you can:

- Switch **Personal AI agents** on or off. When it is off, new approvals are disabled and existing sessions continue until they end or are revoked.
- Choose the scopes you offer: **Read account information** and **Change account settings**.
- Set how people approve. **Only people approve agent requests** needs the approving person's own passkey, and only an Owner or Admin can change it.
- See each active session and press **Revoke**. Other agents the person approved keep working.

## Related

- [How to require MFA, set session length and stop bots](https://help.didit.me/authentication/bot-protection-mfa-and-sessions)
- [Add sign-in to your app](https://help.didit.me/authentication/add-sign-in-to-your-app)
- [Authentication overview in the docs](https://docs.didit.me/authentication/overview)
- [Sign-in methods, organizations and agent access in the docs](https://docs.didit.me/authentication/sign-in-methods)