Default Global Session Policy has a Priority 1 non-default rule enforcing 15-minute idle timeout
signon_global_session_idle_timeout_15min
Every active Okta Global Session Policy needs a Priority 1 rule that is not the built-in Default Rule, setting Maximum Okta global session idle time to 15 minutes or less.
Okta evaluates policies by group assignment, so a permissive custom policy can govern users. Threshold override: okta_max_session_idle_minutes. Aligns with DISA STIG V-273186.
Risk
Without a 15-minute idle timeout, an unattended workstation leaves an authenticated Okta session open indefinitely.
- Session takeover of the user's identity by anyone with physical or remote access
- Lateral movement into every downstream application that trusts Okta SSO
- Bypassed reauthentication even after the user has stepped away
prowler okta --checks signon_global_session_idle_timeout_15min
Recommendation
Configure each active Global Session Policy so a non-default rule at Priority 1:
- Sets Maximum Okta global session idle time to
15minutes or less - Is enabled (
ACTIVE) and evaluated before the built-inDefault Rule
Review group assignments to confirm the rule actually governs the intended users.
Remediation
- Sign in to the Okta Admin Console as a Super Admin.
- Navigate to Security > Global Session Policy.
- Open the Default Policy (and repeat for every other active policy).
- Add or edit a non-default rule.
- Move that rule to Priority 1 so it is evaluated before the built-in
Default Rule. - Set Maximum Okta global session idle time to
15minutes or less. - Save the rule.
Source Code
Resource Type
NotDefined