# Session policy

> Set how long Unifuse sessions last for your institution: the idle timeout and the maximum session length, what counts as activity, and how timeouts are recorded.

Source: https://docs.unifuse.ai/administration/session-policy/

The **Sessions** tab sets two limits that end a user's session automatically.

## Before you start

- You need the *manage institution* permission.
- Open **Administration → Sessions**.

## Settings

| Setting | Range | Default |
|---|---|---|
| **Idle timeout (minutes)** | 5 up to the platform ceiling | 60 |
| **Maximum session length (hours)** | 1 up to the platform ceiling, in half-hour steps, measured from sign-in | the platform ceiling |

The idle timeout cannot be longer than the maximum session length. The platform ceilings are
480 minutes idle and 24 hours maximum.

## How enforcement works

- Both limits are checked on every request. Tightening a limit ends any session that is
  already past it.
- Only things the user does count as activity. Background refreshes, such as the notification
  bell, do not keep a session alive.
- There is no warning before an idle timeout. The user is returned to the sign-in page with a
  message that their session ended.
- Timeouts, expiries and sign-outs are recorded in the [audit log](/administration/audit-log/).

## Related

- [Users](/administration/users/) to sign a specific person out now
- [Your account](/getting-started/your-account/#security) for how users manage their own sessions