Security and sessions
Session lifetimes, ending sessions, and the security practices worth insisting on.
- Written for
- Administrators
- Reading time
- 1 min
- Last reviewed
- August 3, 2026
Sessions are short-lived by design and refreshed transparently while a user is working. Idle sessions expire, and any session can be ended by an administrator.
Ending sessions
Ending a user's sessions signs them out everywhere immediately. Do it whenever a role changes, when a device is lost, and as part of offboarding.
Worth insisting on
- MFA for every account that can reach billing configuration or user management.
- One account per person. Shared logins destroy the attribution that makes the audit trail worth having.
- Deactivation as part of offboarding, on the same day, not at the end of the month.
- Periodic review of who holds tenant admin. It grows quietly.
Related
Signing in, MFA and session expiry
Getting started · 1 min · EveryoneHow authentication works, how to enrol in multi-factor authentication, and why you get signed out.
Inviting and deactivating users
Account & organization · 1 min · AdministratorsAdding colleagues, changing a role, and the right way to handle someone leaving.