Single sign-on: duration, inactivity and sensitive applications

After signing in with a passkey or phone, the browser keeps a single sign-on session that lets people into your organization's other applications without confirming again. Under «Manage» › «Single sign-on» you decide how long it lasts and which applications ignore it.

Which settings are there?

Saving asks for a recent confirmation and is audited.

What does each option change?

• Shortening the duration or inactivity, or adding sensitive applications, also applies to existing sessions at their next use.
• Setting the duration to «Off» ends every single sign-on session of the organization at once.
• A sensitive application always asks for a new confirmation, even with single sign-on. Mark cloud administration consoles and payroll or payments applications this way.

What single sign-on never does

• It never lasts longer than the sign-in that opened it.
• It does not work for the administration console, approving requests or recent confirmations.
• It is not opened by password, one-time code or recovery code sign-ins.
• The server keeps only a digest of the cookie, deleted 24 hours after the session ends.

Shared computers

Use a short duration and inactivity timeout, or turn single sign-on off. There is no way to turn it off on one computer only.

Ending a person's single sign-on sessions

Revoke the person's sessions under «Manage» › «Users» › «Edit» › «Revoke all sessions»: the single sign-on sessions opened from them end too.