The "new" device authorization is not very logical to me.
#1 Owner gets an e-mail with very vague info of what user, device, location etc. which did the request, how could possibly the owner know if the request is relevant or malicious ?
If the requester had to leave som magic string, phone number, e-mail address or something, it would make owner more comfortable
#2 Owner can see a list of authorized and active logged in devices.
This list does not include any more info for identification of user or device than mentioned above (#1). Please explain if I am wrong.
How can owner see a full list of autorized devices (assume a device is stolen, an employee quits etc.) for possibly de-authorize a device?