A useful time to do this is after realizing that a training-room computer may still be signed in. Closing that computer's browser window does not give you a record that its account session was ended.
Review a single session when that is enough
Active sessions can show device or browser details, approximate location, sign-in time, and the current-session marker. Details may be incomplete. If you recognize the device you want to end, select its Log out control and confirm. A trusted device may offer Log out and remove. Session-management controls
Compare several details before deciding what a row represents. A city alone is weak evidence. The browser, time, and whether you used that device together provide a more useful starting point.
For example, this is a fictional personal checklist:
Device I want to stop using: training-room Windows computer
Approximate time I signed in: Tuesday afternoon
Action chosen: log out that session, or all sessions if uncertain
Time action was confirmed: [actual time]
Follow-up: review again after the propagation period
Record the action you actually completed. Do not mark a device signed out just because its row looked unfamiliar.
Know what the session list covers
Active sessions does not manage connected apps, third-party service sessions, or Codex CLI sessions. It is also unavailable for accounts linked to organizational SSO, including SAML or OIDC. A row without an individual logout option can represent the current session or an unavailable session status. Coverage and account restrictions
If an employer controls your sign-in and the page is missing, ask the organization's account administrator which session controls apply. Creating another personal account would not end a session in the managed account.
Treat an unexpected sign-in as a separate security question
Ending sessions addresses existing access. If you suspect someone obtained your credentials, review your sign-in methods and follow OpenAI's account-security guidance for the suspected compromise. The same guidance distinguishes session management from protecting exposed API keys.
You can also configure multi-factor authentication. Enabling MFA does not itself log out devices already signed in. OpenAI's MFA clarification
After confirming the logout, allow the documented propagation time before judging a remaining session. Sign back in on the device you intend to keep using, then review the account rather than repeatedly pressing the same control.