Salesforce Session Settings: Complete Guide
Quick Summary:
Session Settings control how long a Salesforce login stays active, what security level different actions require, and how sessions are protected against hijacking.
What Are Session Settings?
Session Settings govern the lifecycle and security posture of a user's active Salesforce login -- how long it lasts without activity, what conditions can invalidate it early, and what security level (Standard vs High Assurance) different actions require. These settings directly complement MFA as part of an org's overall access security posture.
How to Configure Them
Go to Setup → Session Settings.
Set the session timeout value, balancing security against user convenience for your organization's risk tolerance.
Configure session security options like locking sessions to the originating IP or domain.
Define which actions require High Assurance session security (typically tied to MFA verification).
Save, and communicate any meaningful timeout changes to users before they take effect.
A Real-World Example
A financial services company handling sensitive client data sets a shorter session timeout than Salesforce's default, and requires High Assurance session security (MFA-verified) specifically for viewing certain sensitive fields -- balancing genuine security requirements against not making every single login inconveniently short for routine work.
💡 Pro Tip
Don't set session timeout unnecessarily aggressive without a real security justification -- overly short timeouts frustrate users into workarounds (like staying constantly active in a tab) that don't actually improve security and just create friction.
Frequently Asked Questions
What\'s the default session timeout in Salesforce?
Varies by org configuration, but a common default is 2 hours of inactivity -- this is adjustable in Session Settings based on your organization's security needs.
Can session timeout be different for different profiles?
Session settings are generally org-wide, though session security levels (High Assurance vs Standard) can effectively create different requirements based on what a user is trying to access.
What\'s the difference between session timeout and session security level?
Timeout controls how long an inactive session remains valid; security level determines what a session is permitted to do (e.g. High Assurance sessions, typically requiring MFA, unlock access to more sensitive operations).
Does locking the browser force a new Salesforce login?
Not necessarily -- this depends on session timeout settings and whether "Lock sessions to the IP address from which they originated" or similar policies are enabled.
Can I force all users to be logged out immediately, like after a security incident?
Yes, administrators can force-expire all active sessions from Setup, immediately requiring re-authentication across the org.
What does \'Lock sessions to the domain in which they were first used\' do?
This setting prevents a session token from being reused on a different domain, adding protection against certain session-hijacking attack patterns.
Can session settings affect API access, or only UI logins?
Session security settings primarily govern UI sessions; API access has its own considerations around OAuth token lifetimes and connected app policies.
Is there a maximum session timeout I can set?
Yes, Salesforce enforces both a minimum and maximum bound on session timeout values -- you can't set it to an arbitrarily long or short duration.
Does enabling stricter session settings affect user experience noticeably?
Shorter timeouts mean more frequent re-authentication, which is a genuine tradeoff between security and convenience that should be calibrated to your organization's actual risk profile.
Can session settings require re-authentication for specific sensitive actions?
Yes, High Assurance session security can be required for specific sensitive operations (like viewing certain data or performing admin actions), even within an otherwise-active session.