Last Updated: Sep 27, 2024
Overview
This article clarifies what is the actual duration for the New Universal Login MFA timeout duration from landing to MFA screen.
Applies To
- Multifactor Authentication (MFA)
- New Universal Login MFA
Solution
The challenge screen is tied to the user’s session. Therefore, it will not timeout until either:
- the user completes the challenge,
- the user logs out, killing their session,
- their session lifetime expires.
As a result, controlling the user session expiry also controls the challenge screen.
When a user completes their primary authentication but hasn’t completed MFA, a partial session is created for the user that is awaiting the MFA flow to complete. The user will continue to be faced with the MFA challenge until either their session expires or one of the other two options mentioned above occurs. There is no other way to configure an MFA timeout (other than the session timeout configuration linked above).