How companies manage sign-ins to cloud apps

What is session recording?

Term: Session recording
Meaning: Session recording keeps what someone did between sign-in and sign-out, as video, text or events. Coverage varies by product, and some states require notice.

Updated October 16, 2026 Glossary

Session recording keeps a copy of what a person did in a system between signing in and signing out, so someone can review it later.

What counts as session recording?

A session is one stretch of use, from sign-in to sign-out. Session recording saves what appeared on screen or what the person typed during it, in a form you can go back to. NIST SP 800-53 Rev. 5 covers this as control AU-14, session audit: the ability to record, view, hear or log what happens in a user’s session. NIST notes that it can include keystrokes, websites visited and file transfers. It sits on top of ordinary event logs; it doesn’t replace them.

What does it capture?

Products record in one of three ways:

As video of the screen. Azure Bastion records the screen of remote connections to virtual machines (servers running in the cloud). Teleport, a tool that brokers access to servers and apps, records remote desktop screens and mouse movement.
As typed text and its results. AWS Systems Manager Session Manager logs the commands a person enters and their output.
As a list of events. For web apps, Teleport’s record is a stream of access events, not the screen.

What does it miss?

A recording covers only use that goes through the tool doing the recording. Each product also documents its own gaps. Azure Bastion records only on its Premium tier. Nor does it record connections from the remote-access program on a person’s own computer (Microsoft’s native client). AWS can’t log sessions that use port forwarding or SSH, two ways of tunneling a connection, because it only passes that traffic through. Teleport doesn’t capture keystrokes in remote desktop sessions.

Text logs have a different problem: they keep secrets people type. AWS warns that passwords typed during a session can end up in the log. It recommends commands that don’t show what’s typed on screen.

Who can watch it?

Where recordings are stored, and who can open them, is a separate setting from the recording itself. Azure Bastion saves recordings in a storage container in your own account. To list or play them, a person needs read access to that storage. Check each product’s documentation for how narrowly you can limit viewers.

Do you have to tell employees?

Several states require notice before an employer monitors employees electronically. Recording what people do in work apps may fall under these laws, so check with counsel. AU-14 itself says to plan session auditing with legal counsel.

State	Who and what it covers	Notice it requires	Penalty
New York (Civil Rights Law section 52-c)	Private employers with a place of business in New York (not state or local government) that monitor phone, email or internet access or usage	Written or electronic notice on hiring, acknowledged by the employee, plus a posted notice	Up to $500, $1,000, then $3,000 per offense
Connecticut (Gen. Stat. 31-48d)	Public and private employers that collect information about employees on the employer’s premises by electronic means, computers included	Prior written notice of the types and locations of monitoring, which a posted notice satisfies; new hires since October 1, 2026 also get, before they start, a written plain-language statement of which prohibited activities may be monitored without notice	Up to $500, $1,000, then $3,000 per offense
Delaware (19 Del. C. section 705)	Public and private employers that monitor a Delaware employee’s phone, email or internet use	Electronic notice each day the employee uses company email or internet, or a one-time notice the employee acknowledges	$100 per violation

Each law has exceptions. New York and Delaware exclude processes that manage email, voicemail or internet traffic, aren’t aimed at a particular person, and are used only to maintain or protect the system. Connecticut allows monitoring without prior notice when the employer has reasonable grounds to believe employees are engaged in misconduct and monitoring may produce evidence of it. The act names three kinds: breaking the law, violating the legal rights of the employer or its employees, and creating a hostile workplace. How these laws affect the choice of a recording tool is in How to choose a way to record work on screen.

Frequently asked questions

Is session recording always video?

No. Azure Bastion records the screen, AWS Session Manager logs typed commands and their output as text, and Teleport records desktop screens and mouse movement.

Who can watch the recordings?

That depends on where they're stored and who has access there. Azure Bastion stores them in your own storage account, and viewing them requires the Storage Blob Data Reader role.

Do we have to tell employees we record their work?

In some states, yes. New York, Connecticut and Delaware require employers to give notice of electronic monitoring. NIST's AU-14 also says to plan and run session auditing with legal counsel.

How Junify handles this

Doing this by hand: Single sign-on and multi-factor authentication don't reach apps that can't connect to your identity provider, or accounts that stay shared. Those are left to manual work, and you have to track for yourself which accounts the tools cover.
With Junify: In Junify, recording is on only for the accounts that need it. It's saved as changes to the page rather than as video, so recordings stay small enough to keep for a long time. People see a notice on screen before recording starts, and only that person and admins can watch. Each person verifies who they are, by phone or company login, before opening an account, so even a recording of a shared account is tied to one person.

Try the demo Book a 30-minute demo