Tracking logon sessions in Office365 logs

Question

I am investigating data in O365 logs. Is there a way to distinguish which session a certain activity belonged? for example, if a user has his mobile phone, home PC and work PC logged on, how can I tell which device did the action?

Answer 1

Taken from: Use Office 365 tools for security investigations in Exchange Online and SharePoint Online

To examine the devices and applications from which a specific user connected to a mailbox in Office 365

1. In the Security & Compliance Center, choose Reports > View reports.
2. Under Auditing, choose Azure AD reports.
3. In the Azure management portal, on the Active Directory tab, choose the name of your organization.
4. Under your organization name, choose Users.
5. Locate the user you want to investigate and choose the username.
6. On the user page, choose Devices.
7. In the View drop-down list, select Devices and applications from which the user has signed in. This will provide details, such as the version of client used to sign in, and the last sign-in time, IP address, and location of the user.