Employees currently logged in?

I feel like this is an obvious one, but I can't seem to locate the answer within the help documentation.  Is there an admin function which provides a simple way to know at any given moment who is logged into an instance?  Of course I can look at the login audit trail, which tells me when they last logged in, but I can't really know if they have logged out can I (vs just inactive, or just closed the browser)?  For example, I may need to add a role to a user; if I just simply add a role while