Timeout settings on ADFS

Question

I am trying to figure out the timeout behavior on ADFS (2016). We have the default ssolifetime (8 hours) and tokenlifetime (1 hrs). I understand that the ssolifetime is refresh token while tokenlifetime is the access token. Can someone clarify when a user will need to re-authenticate again with the above settings? Is it 8 hours? Or the ssolifetime get reset automatically when it expired and renew automatically until the persistent SSOlife (default of 90 days) value is reached?

Thanks

Answer 1

@HK G Thanks for reaching out.

Yes for 2016, if the device is registered the SSO can get reset till 90 days with 14 days window.
This is also documented here in detail : https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/ad-fs-single-sign-on-settings#enable-psso-for-office-365-users-to-access-sharepoint-online

-----------------------------------------------------------------------------------------------------------------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

Thanks, our ADFS is not setup with device registration and kmsi is not enabled. Does that mean user will need to reauthenticate after 8 hour by default unless the application also assign a timeout value for the session.