# Session duration, 2FA and sign-in security

*Slack Administrator Study Guide · Governance, Security and Compliance · Last updated October 21, 2026 · https://www.certifyforce.com/study-guide/slack-administrator/governance-security-and-compliance/session-duration-2fa-and-sign-in-security*

How to turn a security policy into Slack settings: desktop and mobile session duration, mandatory two-factor authentication and lockout recovery, 2FA under SSO, invitation approval, and where to get Slack's SOC 2 report.

- Certification: Salesforce Slack Administrator
- Exam section: Governance, Security and Compliance
- Study guide: https://www.certifyforce.com/study-guide/slack-administrator

**Official exam objective:**

> Given a scenario, determine how to configure security policies.

## What the exam expects

- Configure desktop and mobile session duration separately, including sign-out when Slack closes and warnings before sign-out, and explain how a change rolls out.
- Use the session duration API on an Enterprise org when one group needs a different session length from the org setting.
- Turn on mandatory 2FA (with Authenticator apps only when SMS is not allowed), predict what happens to existing people and new invitees, check who has 2FA and restore access for someone locked out.
- Know that 2FA for SSO sign-in is set up in the identity provider and that deleting an SSO configuration signs people out.
- Control who joins with invitation approval and periodic invitation reviews, and send auditors to the compliance portal for Slack's SOC 2 report.

Key terms:
- **Session duration:** how long a member stays signed in on desktop or mobile before Slack asks them to sign back in.
- **Mandatory 2FA:** the setting "Require members to have 2FA set up" under Two-factor authentication for email sign-in.
- **Enterprise org:** an Enterprise organization (Enterprise Grid or Enterprise+ plan); its settings live in Organization settings, while Free, Pro and Business+ use Admin > Workspace settings.
- **SSO configuration:** the identity provider (IdP) connection that signs members in with SAML.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Session duration plans | All plans; new on Free and Pro in 2025 | [Plan updates](https://slack.com/help/articles/39264531104275-Updates-to-feature-availability-and-pricing-for-Slack-plans) |
| Session warnings | Two hours before expiry, final reminder 15 minutes before; desktop setting only | [Manage session duration](https://slack.com/help/articles/115005223763-Manage-session-duration) |
| Rollout of a change | Starts the day it is saved; sessions end randomly over the chosen timeframe | [Manage session duration](https://slack.com/help/articles/115005223763-Manage-session-duration) |
| Per-group session length | Session duration API, Enterprise plans, shorter or longer than the org setting | [Manage session duration](https://slack.com/help/articles/115005223763-Manage-session-duration) |
| Mandatory 2FA deadline | Not set up within 24 hours: signed out until 2FA is set up | [Mandatory 2FA](https://slack.com/help/articles/212221668-Mandatory-workspace-two-factor-authentication) |
| No SMS codes | Authenticator apps only, paid plans | [Mandatory 2FA](https://slack.com/help/articles/212221668-Mandatory-workspace-two-factor-authentication) |
| Owners and admins | Must use 2FA on paid plans even without mandatory 2FA | [Mandatory 2FA](https://slack.com/help/articles/212221668-Mandatory-workspace-two-factor-authentication) |
| Locked-out Workspace Owner | Only the Workspace Primary Owner can turn off their 2FA | [Mandatory 2FA](https://slack.com/help/articles/212221668-Mandatory-workspace-two-factor-authentication) |
| Deleting an SSO configuration | Logs out all members signed in with that IdP | [Manage SSO settings](https://slack.com/help/articles/220403548-Manage-single-sign-on-settings) |
| SOC 2 report | compliance.salesforce.com, Login with Slack | [Data security policies](https://slack.com/help/articles/202014843-Slack-data-security-and-privacy-policies) |

## Check yourself

- Why might members be signed out on the same afternoon an admin sets a seven-day session duration?
- When should an Enterprise org use the session duration API instead of the org setting?
- Why does turning on Slack's mandatory 2FA not add a factor for members who sign in with SSO?
- Where does a Workspace Admin in an Enterprise org check which members have 2FA?

## Sources

- [Manage session duration](https://slack.com/help/articles/115005223763-Manage-session-duration)
- [Mandatory workspace two-factor authentication](https://slack.com/help/articles/212221668-Mandatory-workspace-two-factor-authentication)
- [Manage single sign-on settings](https://slack.com/help/articles/220403548-Manage-single-sign-on-settings)
- [Security tips to protect your workspace](https://slack.com/help/articles/115004155306-Security-tips-to-protect-your-workspace)
- [Invite new members to your workspace](https://slack.com/help/articles/201330256-Invite-new-members-to-your-workspace)
- [Slack data security and privacy policies](https://slack.com/help/articles/202014843-Slack-data-security-and-privacy-policies)
- [Types of roles in Slack](https://slack.com/help/articles/360018112273-Types-of-roles-in-Slack)
- [Updates to feature availability and pricing for Slack plans](https://slack.com/help/articles/39264531104275-Updates-to-feature-availability-and-pricing-for-Slack-plans)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 12 linked practice questions, and unlimited timed mock exams are included with the Slack Administrator pack (USD $19): https://www.certifyforce.com/practice-exams