Match Cloudflare Access session settings to the authentication prompt you expect

A short application token does not always mean another identity-provider login.

Source facts

Cloudflare Access distinguishes global identity sessions from application tokens. An application token can be renewed without another identity-provider login while the global session remains valid and the stored identity still passes policy. A policy-specific duration overrides the application default. When authentication through a Cloudflare One Client session is enabled, that client session takes precedence over application, policy, and global durations. SaaS applications issue their own session cookies, so Access application durations govern their authentication front door rather than every minute spent inside the SaaS application.

Source: Cloudflare — Session management.

Applicability

This concerns Cloudflare Access session behavior, especially self-hosted browser applications and SaaS sign-in. Infrastructure applications and active remote sessions have additional documented behavior that must be reviewed separately.

DSE recommendation

DSE recommends writing the desired outcome in user terms before adjusting a timeout: another policy evaluation, another IdP login, or termination of an application session. Inventory which authentication path each application actually uses. Record client-session authentication, matching policy durations, application defaults, and IdP session settings together. For SaaS, review the application’s own session controls with its owner. Avoid treating a successful sign-in test immediately after a policy edit as proof that an existing session will end at the expected time.

Verification

Use a controlled test account to observe a fresh sign-in, application-token renewal, and expiry of the relevant identity session. Repeat with client-session authentication if enabled. Record which prompt appeared and why, without copying live bearer tokens into the test record.

Official reference

Cloudflare — Session management. Reviewed October 15, 2026.