> ## Documentation Index
> Fetch the complete documentation index at: https://docs.get2dial.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set a session policy

> Set how long a sign-in stays valid, how many devices a user can be signed in on, and how to revoke a session.

Control how long a sign-in stays valid, cap how many devices a user can be signed in on at
once, and revoke a session immediately when you need to.

## Before you start

* Setting a workspace-wide policy needs an **admin** role. Any user can view and revoke their
  own sessions.

## Set a workspace session policy

<Steps>
  <Step title="Go to Settings">
    Select your name, then **Settings**, then **Organization**.
  </Step>

  <Step title="Set the values you need">
    Under **Session policy**, set any of:

    * **Maximum session age** — how long a sign-in stays valid at most, regardless of
      activity. 30 days if you leave this unset.
    * **Idle timeout** — how long a session can sit inactive before it's revoked. Unlimited if
      left unset.
    * **Concurrent session limit** — the most sessions one user can hold at once. Unlimited if
      left unset; when a user exceeds it, Get2Dial revokes their oldest sessions first.
  </Step>

  <Step title="Save">
    Select **Save**.
  </Step>
</Steps>

<Note>
  A maximum session age applies to new sign-ins from that point forward. Idle timeout and
  concurrent limits are checked continuously and apply to sessions that already exist.
</Note>

## Manage your own sessions

<Steps>
  <Step title="Open your settings">
    Select your name, then **Settings**, then **Password & security**.
  </Step>

  <Step title="Review your sessions">
    See every device and browser currently signed in, with when each last had activity.
  </Step>

  <Step title="Revoke one or all others">
    Select **Revoke** next to a single session, or **Sign out everywhere else** to revoke every
    session but the one you're using.
  </Step>
</Steps>

## Verify

<Check>
  A revoked session's user is signed out the next time their browser tries to refresh — within
  a few minutes at most.
</Check>

## Common problems

* **A user needs to be signed out immediately** (lost device, offboarding). In **Users**,
  select the person and turn off their account — this revokes every one of their sessions
  immediately, not just the one you can see.

## Next steps

<CardGroup cols={2}>
  <Card title="Turn on multi-factor authentication" href="/account/multi-factor-authentication" />

  <Card title="Audit log" href="/account/audit-log" />
</CardGroup>