---
title: "Sign out idle SSO user"
slug: "team-account-idle-timeout"
description: "Enhance security with Document360's idle SSO team account logout feature, preventing unauthorized access and ensuring confidentiality in your projects."
updated: 2026-10-21T07:14:37Z
published: 2026-10-21T07:14:37Z
canonical: "docs.document360.com/team-account-idle-timeout"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.document360.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign out idle SSO user

Sign out SSO users automatically after a period of inactivity, so that no one else can use an unattended session in the Knowledge base portal. You turn on an idle timeout in your SAML or OpenID Connect configuration and choose how long a session can stay inactive. The timeout applies only to SSO users. It doesn't affect people who sign in with a Document360 email and password.

---

## When to sign out idle SSO users

- Your knowledge base has confidential or internal content, and your security policy limits how long an inactive session can stay open.
- People use shared or public computers, where a session might be left open.

---

## Before you begin

- Your project must have SSO configured with [SAML](/docs/saml) or [OpenID Connect](/docs/openid).
- You need the **Owner** or **Admin** project role to edit SSO configurations.

---

## How to sign out idle SSO users

1. Go to **Settings** () > **Users & Permissions** > **Enterprise SSO**.
2. Hover over the SSO configuration you want to update and click the **Edit** () icon.
3. In the configuration panel, go to the **More settings** tab.
4. Turn on the **Idle session SSO timeout** toggle.
5. In the **Timeout duration** field, enter the idle time in **HH:MM** (hours:minutes) format, for example `01:30`. The default is 2 hours, and the maximum is 23 hours and 59 minutes.
6. Click **Save**.

![The More settings tab of an SSO configuration with the Idle session SSO timeout toggle and the Timeout duration field.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/idle-session-sso-timeout.png)

SSO users who stay inactive for the duration you set are signed out and must sign in again with SSO.

---

## Considerations

| Item | Limit |
| --- | --- |
| Who is signed out | SSO users only. Users who sign in with a Document360 email and password aren't affected. |
| Default timeout | 2 hours |
| Maximum timeout | 23 hours and 59 minutes |

---

## Best practices

- **Match the timeout to how sensitive your content is.** Use a shorter timeout for confidential content and a longer one where convenience matters more. A shorter timeout is more secure but makes people sign in more often.
- **Keep the default if it fits.** If 2 hours meets your organization's requirements, you don't need to change it.
- **Tell your SSO users about the timeout.** Let them know that inactive sessions end automatically, so they know why they were signed out.
- **Set the timeout on each configuration.** The setting is part of each SSO configuration, so check it on every configuration in your project.

---

## Related articles

  
    
      

SAML

    
    

Set up SAML SSO with your identity provider.

    [Learn more →](/docs/saml)
  
  
    
      

OpenID

    
    

Set up OpenID Connect SSO with your identity provider.

    [Learn more →](/docs/openid)
  
  
    
      

Log in using SSO

    
    

See how users sign in again to the Knowledge base portal with SSO.

    [Learn more →](/docs/login-using-sso-knowledge-base-portal)
  

More on SSO configurations:

- [Deactivating Document360 login page](/docs/disable-document360-login-page)
- [Managing SSO certificates](/docs/managing-sso-certificates)

---

## FAQ

**What happens when a user is signed out because of inactivity?**

The user must sign in again with SSO to get back into the Knowledge base portal.

**Does the idle timeout sign out users who don't use SSO?**

No. The timeout applies only to SSO users. Users who sign in with a Document360 email and password aren't affected.