Account for Google web-session exclusions and the upstream IdP session

A shorter Google web session may renew silently if the upstream identity-provider session is still valid.

Source facts

Google Workspace web-session settings do not cover every client. Google documents exclusions for OAuth-authenticated applications, native mobile apps, and ChromeOS, with separate ChromeOS controls. A changed duration takes effect after users sign out and sign back in; existing sessions keep their prior duration until then. With a third-party identity provider, a still-valid IdP session can renew Google authentication without another interactive sign-in. The Google Admin console has its own fixed one-hour session, separate from the configurable sessions for other Google services.

Source: Google — Session length.

Applicability

This applies to Google Workspace session-length controls on eligible editions. Review the exact browser, mobile, ChromeOS, and third-party IdP paths before promising a universal reauthentication interval.

DSE recommendation

DSE recommends describing the desired reauthentication outcome for each client class. Inventory browser sessions, native mobile apps, and integrations rather than treating them as one population. Coordinate the Google and IdP lifetimes with the identity owner, and plan how existing users will receive the new setting. If an immediate transition is required, review the documented sign-in-cookie reset process and its user impact. Keep the Admin console’s fixed behavior separate in support guidance so its prompt is not mistaken for a failed organization-wide policy.

Verification

Use controlled test accounts to compare a newly signed-in web session, an existing session, and a native client. Repeat through the third-party IdP if used. Record the actual prompt and relevant session state, and confirm the policy outcome without assuming every client follows the web-browser rule.

Official reference

Google — Session length. Reviewed October 15, 2026.