Sign-in security for the whole server

Applies to: Workspace Admins · Time: about 3 minutes

Overview

The session policy decides how long people stay signed in and on how many devices. On a server with one organization, the rules you set in Workspace settings › Security apply to everyone on the server. On a server with several organizations, the IT Admin sets the server's rules, and each Workspace Admin can make them stricter (never looser) for their own organization.

Out of the box, people are signed out after 8 hours of inactivity, can be signed in on up to 3 devices, and a sign-in lasts up to 7 days.

Steps

1. Open Workspace settings → Security.
2. Sign out after inactivity: No limit, 15 or 30 minutes, or 1, 2, 4 or 8 hours. Typing, clicking or scrolling counts as activity; a tab left open in the background doesn't. People get a one-minute warning first.
3. Devices signed in at once (per person): No limit, 1, 2, 3 or 5.
4. When someone signs in on one device too many: Sign out their oldest session, or Refuse the new sign-in.
5. Longest a sign-in lasts: 30 days (default), 8 or 12 hours, 1 day, 3 days or 7 days.
6. Click Save policy. It applies to everyone's current sessions right away.

Who's signed in

Below the policy, Who's signed in lists the members signed in right now and on which devices. If an account may be misused, or a device was lost, click Sign out everywhere on that person's row, then reset their password in User Management.

Good to know

• Every person sees their own devices under Where you're signed in on their profile and can sign out the ones they don't recognise.
• With single sign-on, people are asked to sign in again with Microsoft every 12 hours. See "Setting up Single Sign-On (SSO) with Microsoft 365".