Session and sign in

How long a session lives, whether one person can have two, and how the second step works.

Acceptance criteria

US-41 Session Management HIGHEST NEW SCREEN

As a portal user, I want my session to time out after inactivity and fully end on logout, so that my account can't be accessed from an unattended or stale session.

Inactive session times out after a configurable period → re-auth required.
Concurrent-session rule defined (allow/deny/limit).
Logout fully invalidates the session token.

US-10 2FA Login (Microsoft) + Auto-Unlock HIGHEST NEW SCREEN

As a portal user, I want to log in using Microsoft Authenticator or email OTP, so my account is protected beyond a password.

Given a user has Multi-Factor Authenticator enrolled via Microsoft Entra, when they log in with correct credentials, then they are prompted for Authenticator approval or email OTP before access is granted.
Given a user fails MFA 5 times, when the 5th attempt fails, then the account is temporarily locked per security policy. Auto-unlock after 15 min.
After auto-unlock and another 3 failed attempts within 24 hours, account is temporarily locked for admin to unlock. (full admin-unlock go to US-54).
Given MFA is enabled, when an existing user without enrollment logs in, then they are forced through enrollment before proceeding.

US-30 Email OTP (Secondary 2FA) LOWEST NEW SCREEN

As a portal user, I want Email OTP as an alternative second factor, so that I can use 2FA without the Authenticator app.

Email OTP option at login.
Expired code → clear "request new code" message.
Additive to US-10, Authenticator OTP unchanged.

Session

Sign out after no activity for

A warning appears 2 minutes before.

Longest a session can last

If the same person signs in again elsewhereAllow both sessionsSign the older session outThey see: Another session is openRefuse the new sign in

Signing out ends the session completely. The old session cannot be reopened with the back button.

Two-step sign in

Require two-step sign in for everyone

Microsoft Authenticator, set up through Microsoft EntraOn

Email code as an alternative

Email code length

Code valid for

After that the user asks for a new code.

Existing users. Users who signed in before and never set it up are taken through setup the next time they sign in.

Today

Idle limit: 20 minutes, warning at 18
Longest session: 12 hours
Second sign in: Older session is signed out
Two-step sign in: Required for 17 users, 17 enrolled
Sign in events: See them in the audit log

What the user sees

2 minutes before the limit, a "Still there?" box with Stay signed in and Sign out.Preview

At the limit, the session ends and the sign in page says the session timed out.Preview

On a second sign in, the older session ends and sees "Another session is open".Preview

Sign out ends the session at once. The old tab cannot reopen it.Preview

BackSave settings