How to set SessionNotOnOrAfter attribute in Entra ID?

Question

Jestin Ma 20

GitHub supports the SessionNotOnOrAfter attribute in the AuthnStatement element.

However, I do not see that attribute in the SAML docs for Entra.

Can anyone confirm whether it is possible to set this attribute from Entra ID?

Marilee Turscak-MSFT 37,271 Reputation points Microsoft Employee Moderator

2024-04-03T21:09:00.6866667+00:00

Hi @Jestin Ma , just checking to see if you were able to get the information you needed and whether you had further questions? If any of the answers provided helped you, please remember to accept the answer so that others in the community researching similar questions can more easily find a resolution. Otherwise let us know if you have further concerns.

Answer accepted by question author

1 additional answer

Marilee Turscak-MSFT 37,271 Reputation points Microsoft Employee Moderator

2024-04-03T21:09:00.6866667+00:00

Hi @Jestin Ma , just checking to see if you were able to get the information you needed and whether you had further questions? If any of the answers provided helped you, please remember to accept the answer so that others in the community researching similar questions can more easily find a resolution. Otherwise let us know if you have further concerns.

Answer 1

Marilee Turscak-MSFT 37,271 Microsoft Employee Moderator

Entra ID does not support SessionNotOnOrAfter attribute and does not allow configuration of session lifetimes derived from the SAML Response.

Github uses the SAML SessionNotOnOrAfter value on the SAML Assertion to define the relying application's session length (See Page 27 of the SAML spec: http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf_

A potential solution would be to configure conditional access policies with session frequency.

Jestin Ma 20 Reputation points

2025-07-23T22:39:52.7833333+00:00

I realize this is quite late, but are there any plans or objections to supporting SessionNotOnOrAfter in Entra ID?

Answer 2

Vasil Michev 123.6K MVP Volunteer Moderator

Have you looked at the refreshTokensValidFromDateTime attribute? Here's the corresponding Graph method: https://learn.microsoft.com/en-us/graph/api/user-invalidateallrefreshtokens?view=graph-rest-beta&tabs=http

Jestin Ma 20 Reputation points

2024-04-01T19:21:54.2033333+00:00

I believe that is a separate attribute which controls SAML token lifetime. SessionNotOnOrAfter controls the session duration/timeout on the application side (after which the user will be required to re-authenticate and may or may not hit the SAML token lifetime).