Session policy

The Sessions tab sets two limits that end a user’s session automatically.

Before you start

• You need the manage institution permission.
• Open Administration → Sessions.

Settings

Setting	Range	Default
Idle timeout (minutes)	5 up to the platform ceiling	60
Maximum session length (hours)	1 up to the platform ceiling, in half-hour steps, measured from sign-in	the platform ceiling

The idle timeout cannot be longer than the maximum session length. The platform ceilings are 480 minutes idle and 24 hours maximum.

How enforcement works

• Both limits are checked on every request. Tightening a limit ends any session that is already past it.
• Only things the user does count as activity. Background refreshes, such as the notification bell, do not keep a session alive.
• There is no warning before an idle timeout. The user is returned to the sign-in page with a message that their session ended.
• Timeouts, expiries and sign-outs are recorded in the audit log.

Related

• Users to sign a specific person out now
• Your account for how users manage their own sessions