How to set SessionNotOnOrAfter attribute in Entra ID?

Question

GitHub supports the SessionNotOnOrAfter attribute in the AuthnStatement element.

https://docs.github.com/en/enterprise-cloud@latest/admin/identity-and-access-management/iam-configuration-reference/saml-configuration-reference#session-duration-and-timeout

However, I do not see that attribute in the SAML docs for Entra.

https://learn.microsoft.com/en-us/entra/identity-platform/single-sign-on-saml-protocol

---

Can anyone confirm whether it is possible to set this attribute from Entra ID?

Answer 1

Hi @Jestin Ma ,

Entra ID does not support SessionNotOnOrAfter attribute and does not allow configuration of session lifetimes derived from the SAML Response.

Github uses the SAML SessionNotOnOrAfter value on the SAML Assertion to define the relying application's session length (See Page 27 of the SAML spec: http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf_

A potential solution would be to configure conditional access policies with session frequency.

Answer 2

Have you looked at the refreshTokensValidFromDateTime attribute? Here's the corresponding Graph method: https://learn.microsoft.com/en-us/graph/api/user-invalidateallrefreshtokens?view=graph-rest-beta&tabs=http