Session policies control how long organization members stay signed in. Organization owners and admins can configure them on Enterprise plans, or on self-hosted deployments where session policies are enabled.
The limits apply to member sign-in sessions across devices, including SSO sessions. Your identity provider can enforce additional session rules.
Set session limits
Open Settings → Organization → Security → Session policies. Enter whole numbers in hours, then select Save. Discard restores the saved values.
| Setting | Behavior | Accepted values |
|---|---|---|
| Max session lifetime (hours) | Caps a session's age from sign-in, regardless of activity. A value of 168 requires sign-in again at least weekly. | 1–8760 hours |
| Idle timeout (hours) | Expires a session after inactivity. Activity refreshes the session within any maximum lifetime. | 48–8760 hours |
Both fields are optional. Leaving a field empty removes that organization limit. With neither limit set, sessions use the default 30-day sliding expiry and extend automatically while a member stays active.
The idle minimum is 48 hours because session activity refreshes are recorded at most once every 24 hours. A shorter limit could expire a session while its member is actively using Sim.
How enforcement works
- New sign-ins receive an expiry constrained by the current policy.
- Saving a tighter policy shortens existing member sessions. Changes reach other application instances within about a minute.
- Saving a looser policy does not immediately extend stored session expiries. Later session refreshes and new sign-ins use the current limits.
When a session expires, the member must sign in again on their next request. Workflow changes that have already synced remain saved; don't rely on session recovery to preserve an edit that has not synced.
Sign out all members
Use Sign out all members after a security incident or when you need members to authenticate again. Confirm the action to revoke the organization's member sessions, except your current session. Your sessions on other devices are also revoked.
Members must sign in again on their next request, typically within a minute. Revocation affects sign-in sessions only: API keys, deployed workflows, webhooks, and schedules keep working. Manage those credentials and resources separately when offboarding a member or responding to an incident.