# What is session recording?

Session recording keeps what someone did between sign-in and sign-out, as video, text or events. Coverage varies by product, and some states require notice.

Updated: October 16, 2026

Session recording keeps a copy of what a person did in a system between signing in and signing out, so someone can review it later.

## What counts as session recording?

A session is one stretch of use, from sign-in to sign-out. Session recording saves what appeared on screen or what the person typed during it, in a form you can go back to. NIST SP 800-53 Rev. 5 covers this as control AU-14, session audit: the ability to record, view, hear or log what happens in a user's session. NIST notes that it can include keystrokes, websites visited and file transfers. It sits on top of ordinary event logs; it doesn't replace them.

## What does it capture?

Products record in one of three ways:

- As video of the screen. Azure Bastion records the screen of remote connections to virtual machines (servers running in the cloud). Teleport, a tool that brokers access to servers and apps, records remote desktop screens and mouse movement.
- As typed text and its results. AWS Systems Manager Session Manager logs the commands a person enters and their output.
- As a list of events. For web apps, Teleport's record is a stream of access events, not the screen.

## What does it miss?

A recording covers only use that goes through the tool doing the recording. Each product also documents its own gaps. Azure Bastion records only on its Premium tier. Nor does it record connections from the remote-access program on a person's own computer (Microsoft's native client). AWS can't log sessions that use port forwarding or SSH, two ways of tunneling a connection, because it only passes that traffic through. Teleport doesn't capture keystrokes in remote desktop sessions.

Text logs have a different problem: they keep secrets people type. AWS warns that passwords typed during a session can end up in the log. It recommends commands that don't show what's typed on screen.

## Who can watch it?

Where recordings are stored, and who can open them, is a separate setting from the recording itself. Azure Bastion saves recordings in a storage container in your own account. To list or play them, a person needs read access to that storage. Check each product's documentation for how narrowly you can limit viewers.

## Do you have to tell employees?

Several states require notice before an employer monitors employees electronically. Recording what people do in work apps may fall under these laws, so check with counsel. AU-14 itself says to plan session auditing with legal counsel.

| State | Who and what it covers | Notice it requires | Penalty |
| --- | --- | --- | --- |
| New York (Civil Rights Law section 52-c) | Private employers with a place of business in New York (not state or local government) that monitor phone, email or internet access or usage | Written or electronic notice on hiring, acknowledged by the employee, plus a posted notice | Up to $500, $1,000, then $3,000 per offense |
| Connecticut (Gen. Stat. 31-48d) | Public and private employers that collect information about employees on the employer's premises by electronic means, computers included | Prior written notice of the types and locations of monitoring, which a posted notice satisfies; new hires since October 1, 2026 also get, before they start, a written plain-language statement of which prohibited activities may be monitored without notice | Up to $500, $1,000, then $3,000 per offense |
| Delaware (19 Del. C. section 705) | Public and private employers that monitor a Delaware employee's phone, email or internet use | Electronic notice each day the employee uses company email or internet, or a one-time notice the employee acknowledges | $100 per violation |

Each law has exceptions. New York and Delaware exclude processes that manage email, voicemail or internet traffic, aren't aimed at a particular person, and are used only to maintain or protect the system. Connecticut allows monitoring without prior notice when the employer has reasonable grounds to believe employees are engaged in misconduct and monitoring may produce evidence of it. The act names three kinds: breaking the law, violating the legal rights of the employer or its employees, and creating a hostile workplace. How these laws affect the choice of a recording tool is in [How to choose a way to record work on screen](/guides/access-basics/choosing-session-recording).


## Frequently asked questions

**Is session recording always video?**

No. Azure Bastion records the screen, AWS Session Manager logs typed commands and their output as text, and Teleport records desktop screens and mouse movement.

**Who can watch the recordings?**

That depends on where they're stored and who has access there. Azure Bastion stores them in your own storage account, and viewing them requires the Storage Blob Data Reader role.

**Do we have to tell employees we record their work?**

In some states, yes. New York, Connecticut and Delaware require employers to give notice of electronic monitoring. NIST's AU-14 also says to plan and run session auditing with legal counsel.

## Sources

- [NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (AU-14)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf)
- [Microsoft Learn: Record Bastion sessions - Azure Bastion](https://learn.microsoft.com/en-us/azure/bastion/session-recording)
- [Microsoft Learn: Configure Bastion for native client connections - Azure Bastion](https://learn.microsoft.com/en-us/azure/bastion/native-client)
- [AWS Systems Manager User Guide: Enabling and disabling session logging](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-logging.html)
- [Teleport Docs: Session Recording](https://goteleport.com/docs/reference/architecture/session-recording/)
- [New York Civil Rights Law section 52-c (second of two sections so numbered), electronic monitoring](https://www.nysenate.gov/legislation/laws/CVR/52-C*2)
- [Connecticut Public Act No. 26-73, An Act Concerning the Electronic Surveillance of Employees (amending Conn. Gen. Stat. 31-48d)](https://prdext2.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00073-R00SB-00472-PA.PDF)
- [Delaware Code, Title 19, Chapter 7, Subchapter I, section 705](https://delcode.delaware.gov/title19/c007/sc01/index.html)

## How Junify handles this

**Doing this by hand** Single sign-on and multi-factor authentication don't reach apps that can't connect to your identity provider, or accounts that stay shared. Those are left to manual work, and you have to track for yourself which accounts the tools cover.

**With Junify** In Junify, recording is on only for the accounts that need it. It's saved as changes to the page rather than as video, so recordings stay small enough to keep for a long time. People see a notice on screen before recording starts, and only that person and admins can watch. Each person verifies who they are, by phone or company login, before opening an account, so even a recording of a shared account is tied to one person.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&from=guide&cluster=access-basics&slug=what-is-session-recording)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [What's the difference between an audit log and audit evidence?](/guides/access-basics/audit-log-vs-evidence): An audit log is what a system records. Audit evidence is a log you can rely on: tied to a person, protected from change, kept for a set period, and reviewed.
- [What a browser extension can and can't control in access management](/guides/access-basics/browser-extension-access-control-scope): An extension works inside the browser it's installed in, on the sites it's allowed to run on. Other apps, other browsers and other devices are out of its reach.
- [What work data stays on a personal computer, and how to keep it off](/guides/access-basics/byod-leave-no-business-data): History, cookies, saved passwords, password manager copies and downloads. Pair company browser settings with logins that don't show people the password.