12 Web session-length control

A Workspace web session lasts 14 days by default, and the session cookie is a complete credential for whatever remains of that window — no password, no second factor. This setting caps the window per OU and sets what re-authentication costs when it lapses. On macOS, where device-bound session credentials (№10) do not apply, it is the primary mitigation for cookie theft: its whole value is the ceiling it puts on how long a stolen cookie is worth stealing.

Documentation: Set session length for Google services ↗

Caveats

Sessions do not shorten retroactively¹
The Admin console’s own session is fixed at 1 hour and cannot be changed²
Native mobile apps ignore this entirely³
If SSO (№15) is in play, the IdP’s session must expire first⁴

Setup steps

open ↗
https://admin.google.com/ac/managedsettings/352555445522/sessionmanagementsettings · captured 2026-07-15
Security › Access and data control › Google session control
Select the target OU (organizational unit) — admins and high-risk users get the short window; general staff can get a longer one — and open Web session duration.

Web session duration = 8 hours for admin/high-risk OUs; 1–7 days for general staff (default is 14 days)
Security › Access and data control › Google session control
This screen sets the session duration. To also choose what re-authentication demands (password vs security key), use Google Cloud session control, which №38 configures — pair the two wherever admins hold GCP roles.

Web session duration
the chosen ceiling (re-auth method: №38)
Security › Access and data control › Google session control
Save, then verify: sessions do not shorten retroactively. Reset sign-in cookies for each affected user so the new duration binds — the console does this one user at a time, so script it with GAM for a whole OU.

Directory > Users > (user) > Security > Sign-in cookies > Reset — or GAM `gam user <x> signout`

Sign a user out of a managed Google Account ↗

How to verify

Confirm the session-length policy on the OU in the console, then leave a test session idle past the ceiling and confirm it demands re-authentication.

v0.1.3Prevent policy #3 · #29 ↗