12 Web session-length control

Caveats

• The Admin console’s own session is fixed at 1 hour and cannot be changed — this setting governs Gmail, Drive and the rest of the web apps.
• Native mobile apps ignore this entirely — a short web session and an effectively permanent Gmail-on-iOS session coexist happily.
• If SSO (№22) is in play, set the IdP’s session to expire before this ceiling — when the Google session lapses, Google renews it without a fresh sign-in as long as the IdP session is still valid, so a longer-lived IdP session makes this setting cosmetic and a revoked IdP user keeps working until the IdP session dies. The re-auth is a silent redirect the user never notices, which means neither does the attacker.
• DBSC account-binding changes this control’s arithmetic: once a device-bound fleet is confirmed (Windows-only as of 2026-07 — Google’s server side does not yet offer DBSC registration to macOS clients), a stolen cookie stops replaying off-device and the staff ceiling can drift back toward the 14-day default. Verify coverage in the Investigation tool’s DBSC binding events before relaxing, and keep the short admin window regardless — binding does nothing against an AiTM-established session, malware acting inside the live browser, or a hijacked in-browser agent, and third-party SaaS cookies stay unbound.

Setup steps

1. 1. Select the target OU (organizational unit) — admins and high-risk users get the short window; general staff can get a longer one — and open Web session duration.
   open ↗

   

   https://admin.google.com/ac/managedsettings/352555445522/sessionmanagementsettings · captured 2026-07-15

   Security › Access and data control › Google session control

   Web session duration = 8 hours for admin/high-risk OUs; 1–7 days for general staff (default is 14 days)

2. 2. This screen sets the session duration. To also choose what re-authentication demands (password vs security key), use Google Cloud session control, which №40 configures — pair the two wherever admins hold GCP roles.
   open ↗

   

   https://admin.google.com/ac/sc/investigation · captured 2026-07-15

   Security › Access and data control › Google session control

   Web session duration

   the chosen ceiling (re-auth method: №40)

3. 3. Save, then verify: sessions do not shorten retroactively. Reset sign-in cookies for each affected user so the new duration binds — the console does this one user at a time, so script it with GAM for a whole OU.

   Security › Access and data control › Google session control

   Directory > Users > (user) > Security > Sign-in cookies > Reset — or GAM `gam user <x> signout`

How to verify

1. Confirm the session-length policy on the OU in the console, then leave a test session idle past the ceiling and confirm it demands re-authentication.