{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/google-workspace-web-session-exclusions-idp-renewal/", "item": { "id": "https://update.dsesecurity.com/updates/google-workspace-web-session-exclusions-idp-renewal/", "slug": "google-workspace-web-session-exclusions-idp-renewal", "url": "https://update.dsesecurity.com/updates/google-workspace-web-session-exclusions-idp-renewal/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/google-workspace-web-session-exclusions-idp-renewal.md", "json": "https://update.dsesecurity.com/api/v1/posts/google-workspace-web-session-exclusions-idp-renewal/" }, "title": "Account for Google web-session exclusions and the upstream IdP session", "summary": "A shorter Google web session may renew silently if the upstream identity-provider session is still valid.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "microsoft-365-identity", "name": "Microsoft 365 & Identity", "url": "https://update.dsesecurity.com/topic/microsoft-365-identity/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T13:33:55+00:00", "modified_at": "2026-10-15T13:36:18+00:00", "reviewed_on": "2026-10-15", "reading_minutes": 2, "word_count": 270, "potentially_affected": "This applies to Google Workspace session-length controls on eligible editions. Review the exact browser, mobile, ChromeOS, and third-party IdP paths before promising a universal reauthentication interval.", "dse_recommendation": "DSE recommends describing the desired reauthentication outcome for each client class.", "primary_source": { "name": "Google — Session length", "url": "https://knowledge.workspace.google.com/admin/security/set-session-length-for-google-services?hl=en", "published_on": null, "authority": "knowledge.workspace.google.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A shorter Google web session may renew silently if the upstream identity-provider session is still valid.

\n

Source facts

\n

Google Workspace web-session settings do not cover every client. Google documents exclusions for OAuth-authenticated applications, native mobile apps, and ChromeOS, with separate ChromeOS controls. A changed duration takes effect after users sign out and sign back in; existing sessions keep their prior duration until then. With a third-party identity provider, a still-valid IdP session can renew Google authentication without another interactive sign-in. The Google Admin console has its own fixed one-hour session, separate from the configurable sessions for other Google services.

\n

Source: Google — Session length.

\n

Applicability

\n

This applies to Google Workspace session-length controls on eligible editions. Review the exact browser, mobile, ChromeOS, and third-party IdP paths before promising a universal reauthentication interval.

\n

DSE recommendation

\n

DSE recommends describing the desired reauthentication outcome for each client class. Inventory browser sessions, native mobile apps, and integrations rather than treating them as one population. Coordinate the Google and IdP lifetimes with the identity owner, and plan how existing users will receive the new setting. If an immediate transition is required, review the documented sign-in-cookie reset process and its user impact. Keep the Admin console’s fixed behavior separate in support guidance so its prompt is not mistaken for a failed organization-wide policy.

\n

Verification

\n

Use controlled test accounts to compare a newly signed-in web session, an existing session, and a native client. Repeat through the third-party IdP if used. Record the actual prompt and relevant session state, and confirm the policy outcome without assuming every client follows the web-browser rule.

\n

Official reference

\n

Google — Session length. Reviewed October 15, 2026.

", "content_text": "A shorter Google web session may renew silently if the upstream identity-provider session is still valid.\nSource facts\nGoogle Workspace web-session settings do not cover every client. Google documents exclusions for OAuth-authenticated applications, native mobile apps, and ChromeOS, with separate ChromeOS controls. A changed duration takes effect after users sign out and sign back in; existing sessions keep their prior duration until then. With a third-party identity provider, a still-valid IdP session can renew Google authentication without another interactive sign-in. The Google Admin console has its own fixed one-hour session, separate from the configurable sessions for other Google services.\nSource: Google — Session length.\nApplicability\nThis applies to Google Workspace session-length controls on eligible editions. Review the exact browser, mobile, ChromeOS, and third-party IdP paths before promising a universal reauthentication interval.\nDSE recommendation\nDSE recommends describing the desired reauthentication outcome for each client class. Inventory browser sessions, native mobile apps, and integrations rather than treating them as one population. Coordinate the Google and IdP lifetimes with the identity owner, and plan how existing users will receive the new setting. If an immediate transition is required, review the documented sign-in-cookie reset process and its user impact. Keep the Admin console’s fixed behavior separate in support guidance so its prompt is not mistaken for a failed organization-wide policy.\nVerification\nUse controlled test accounts to compare a newly signed-in web session, an existing session, and a native client. Repeat through the third-party IdP if used. Record the actual prompt and relevant session state, and confirm the policy outcome without assuming every client follows the web-browser rule.\nOfficial reference\nGoogle — Session length. Reviewed October 15, 2026.", "content_markdown": "A shorter Google web session may renew silently if the upstream identity-provider session is still valid.\n\n## Source facts\n\nGoogle Workspace web-session settings do not cover every client. Google documents exclusions for OAuth-authenticated applications, native mobile apps, and ChromeOS, with separate ChromeOS controls. A changed duration takes effect after users sign out and sign back in; existing sessions keep their prior duration until then. With a third-party identity provider, a still-valid IdP session can renew Google authentication without another interactive sign-in. The Google Admin console has its own fixed one-hour session, separate from the configurable sessions for other Google services.\n\nSource: [Google — Session length](https://knowledge.workspace.google.com/admin/security/set-session-length-for-google-services?hl=en).\n\n## Applicability\n\nThis applies to Google Workspace session-length controls on eligible editions. Review the exact browser, mobile, ChromeOS, and third-party IdP paths before promising a universal reauthentication interval.\n\n## DSE recommendation\n\nDSE recommends describing the desired reauthentication outcome for each client class. Inventory browser sessions, native mobile apps, and integrations rather than treating them as one population. Coordinate the Google and IdP lifetimes with the identity owner, and plan how existing users will receive the new setting. If an immediate transition is required, review the documented sign-in-cookie reset process and its user impact. Keep the Admin console’s fixed behavior separate in support guidance so its prompt is not mistaken for a failed organization-wide policy.\n\n## Verification\n\nUse controlled test accounts to compare a newly signed-in web session, an existing session, and a native client. Repeat through the third-party IdP if used. Record the actual prompt and relevant session state, and confirm the policy outcome without assuming every client follows the web-browser rule.\n\n## Official reference\n\n[Google — Session length](https://knowledge.workspace.google.com/admin/security/set-session-length-for-google-services?hl=en). Reviewed October 15, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/google-workspace-web-session-exclusions-idp-renewal/", "url": "https://update.dsesecurity.com/updates/google-workspace-web-session-exclusions-idp-renewal/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-15" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/google-workspace-web-session-exclusions-idp-renewal/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Account for Google web-session exclusions and the upstream IdP session", "item": "https://update.dsesecurity.com/updates/google-workspace-web-session-exclusions-idp-renewal/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/google-workspace-web-session-exclusions-idp-renewal/#article", "identifier": "https://update.dsesecurity.com/updates/google-workspace-web-session-exclusions-idp-renewal/", "url": "https://update.dsesecurity.com/updates/google-workspace-web-session-exclusions-idp-renewal/", "headline": "Account for Google web-session exclusions and the upstream IdP session", "description": "A shorter Google web session may renew silently if the upstream identity-provider session is still valid.", "abstract": "A shorter Google web session may renew silently if the upstream identity-provider session is still valid.", "articleBody": "A shorter Google web session may renew silently if the upstream identity-provider session is still valid.\nSource facts\nGoogle Workspace web-session settings do not cover every client. Google documents exclusions for OAuth-authenticated applications, native mobile apps, and ChromeOS, with separate ChromeOS controls. A changed duration takes effect after users sign out and sign back in; existing sessions keep their prior duration until then. With a third-party identity provider, a still-valid IdP session can renew Google authentication without another interactive sign-in. The Google Admin console has its own fixed one-hour session, separate from the configurable sessions for other Google services.\nSource: Google — Session length.\nApplicability\nThis applies to Google Workspace session-length controls on eligible editions. Review the exact browser, mobile, ChromeOS, and third-party IdP paths before promising a universal reauthentication interval.\nDSE recommendation\nDSE recommends describing the desired reauthentication outcome for each client class. Inventory browser sessions, native mobile apps, and integrations rather than treating them as one population. Coordinate the Google and IdP lifetimes with the identity owner, and plan how existing users will receive the new setting. If an immediate transition is required, review the documented sign-in-cookie reset process and its user impact. Keep the Admin console’s fixed behavior separate in support guidance so its prompt is not mistaken for a failed organization-wide policy.\nVerification\nUse controlled test accounts to compare a newly signed-in web session, an existing session, and a native client. Repeat through the third-party IdP if used. Record the actual prompt and relevant session state, and confirm the policy outcome without assuming every client follows the web-browser rule.\nOfficial reference\nGoogle — Session length. Reviewed October 15, 2026.", "datePublished": "2026-10-15T13:33:55+00:00", "dateModified": "2026-10-15T13:36:18+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/google-workspace-web-session-exclusions-idp-renewal/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/google-workspace-web-session-exclusions-idp-renewal/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Account for Google web-session exclusions and the upstream IdP session" }, "articleSection": [ "Cybersecurity", "Microsoft 365 & Identity" ], "keywords": [ "Cybersecurity", "Microsoft 365 & Identity", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Microsoft 365 & Identity", "url": "https://update.dsesecurity.com/topic/microsoft-365-identity/" } ], "wordCount": 270, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Google — Session length", "url": "https://knowledge.workspace.google.com/admin/security/set-session-length-for-google-services?hl=en" } } ] } }