# Session policies (/platform/enterprise/session-policies)



Session policies control how long organization members stay signed in. Organization owners and admins can configure them on Enterprise plans, or on self-hosted deployments where session policies are enabled.

The limits apply to member sign-in sessions across devices, including SSO sessions. Your identity provider can enforce additional session rules.

## Set session limits [#set-session-limits]

Open **Settings → Organization → Security → Session policies**. Enter whole numbers in hours, then select **Save**. **Discard** restores the saved values.

| Setting | Behavior | Accepted values |
| - | - | - |
| **Max session lifetime (hours)** | Caps a session's age from sign-in, regardless of activity. A value of `168` requires sign-in again at least weekly. | 1–8760 hours |
| **Idle timeout (hours)** | Expires a session after inactivity. Activity refreshes the session within any maximum lifetime. | 48–8760 hours |

Both fields are optional. Leaving a field empty removes that organization limit. With neither limit set, sessions use the default 30-day sliding expiry and extend automatically while a member stays active.

The idle minimum is 48 hours because session activity refreshes are recorded at most once every 24 hours. A shorter limit could expire a session while its member is actively using Sim.

## How enforcement works [#how-enforcement-works]

* New sign-ins receive an expiry constrained by the current policy.
* Saving a tighter policy shortens existing member sessions. Changes reach other application instances within about a minute.
* Saving a looser policy does not immediately extend stored session expiries. Later session refreshes and new sign-ins use the current limits.

When a session expires, the member must sign in again on their next request. Workflow changes that have already synced remain saved; don't rely on session recovery to preserve an edit that has not synced.

## Sign out all members [#sign-out-all-members]

Use **Sign out all members** after a security incident or when you need members to authenticate again. Confirm the action to revoke the organization's member sessions, except **your current session**. Your sessions on other devices are also revoked.

Members must sign in again on their next request, typically within a minute. Revocation affects sign-in sessions only: API keys, deployed workflows, webhooks, and schedules keep working. Manage those credentials and resources separately when offboarding a member or responding to an incident.

## Related docs [#related-docs]

* [Single sign-on](/platform/enterprise/sso)
* [Directory provisioning](/platform/enterprise/scim)
* [Self-hosted enterprise](/platform/enterprise/self-hosted)