Session lifetimes

The idle limit counts from your last activity, not from sign-in. A request to identity moves the idle deadline to "now plus the idle limit", and the deadline is capped at the absolute limit. Identity records activity at most once a minute for a session, which is far below the shortest idle limit allowed.

The absolute limit never moves. After 14 days a session ends, and you sign in again.

An organization can set its own idle and absolute limits, and a cap on concurrent sessions. The platform keeps each value inside a range, so an organization can shorten sessions a lot or lengthen them a little, but not without limit.

Organizations can sit inside other organizations. A child organization inherits its parent's settings and can only tighten them, never loosen them.

Two rules follow from how the settings are read.

• It applies at sign-in. The limits are read when the session is created, for a sign-in scoped to the organization. A change an organization makes later affects new sessions only. A person who signed in without choosing an organization gets the platform defaults.
• A stricter organization is enforced when an application asks. When an application sends someone to sign in to an organization whose absolute limit is shorter than 14 days, a session older than that limit is asked to sign in again. If the organization's idle limit is shorter than 12 hours, a session that has been idle longer than that is asked to sign in again. A session opened under looser rules therefore cannot outlast a stricter organization's limits. An organization on the platform defaults adds no extra check.

You can see when a session ends. The Expires column on the Sessions page is the absolute end of the session. See Sessions and devices.

Where it is available, the sign-in page shows a box labelled Keep me signed in on this device, with the hint Only on a device you control. Ticking it asks for a longer session. Three things limit it:

• It is available only where the deployment offers it.
• It can only lengthen a session on the platform defaults. It is refused for an organization that has chosen shorter limits than the defaults, and for one that requires assurance level 2 or higher.
• An organization's own limits still have the last word.
• It is never offered for a sign-in that used the lost-passkey emailed code, or for a limited session opened with Continue with my password only (limited session).

A session is one part of sign-in. These are the others, so you can tell which clock is running.

A refresh token's absolute expiry never goes past the session's absolute limit, and a refresh is refused once the session has ended. A shorter session therefore shortens everything that depends on it.

• Sessions
• Cookies
• Organizations
• Step-up