# Session duration, 2FA, domain claiming and EMM

*Slack Consultant Study Guide · Policies and Settings · Last updated October 21, 2026 · https://www.certifyforce.com/study-guide/slack-consultant/policies-and-settings/session-duration-2fa-domain-claiming-and-emm*

The org-level security settings a consultant walks a client through: how session duration changes roll out and when to use the session duration API, mandatory 2FA versus MFA in the identity provider, claiming domains to block external workspaces, and turning on Enterprise Mobility Management with the required AppConfig keys.

- Certification: Salesforce Slack Consultant
- Exam section: Policies and Settings
- Study guide: https://www.certifyforce.com/study-guide/slack-consultant

**Official exam objective:**

> Guide clients through key org-level security settings.

## What the exam expects

- Explain how a session duration change rolls out and recommend the session duration API for a subset of members.
- Plan a mandatory 2FA rollout (24-hour window, authenticator apps only) and know when MFA belongs in the identity provider instead.
- Recommend domain claiming to stop employees joining external workspaces with the company domain.
- Describe how EMM is turned on, which AppConfig keys are required, and what to tell members.

Key terms:
- **Session duration**: how long members stay signed in before they must reauthenticate, set separately for desktop and mobile.
- **Mandatory 2FA**: Slack's own second factor for email-and-password sign-in.
- **Domain claiming**: proving ownership of an email domain with a DNS TXT record so Slack can restrict how that domain is used.
- **EMM**: Enterprise Mobility Management, which limits Slack access to managed apps and devices.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Session duration rollout | Starts that day, sessions end randomly over the chosen timeframe | [Session duration](https://slack.com/help/articles/115005223763-Manage-session-duration) |
| Expiry warnings | Two hours before, final reminder 15 minutes before | [Session duration](https://slack.com/help/articles/115005223763-Manage-session-duration) |
| Different duration for a subset | Session duration API, Enterprise plans | [Session duration](https://slack.com/help/articles/115005223763-Manage-session-duration) |
| Session duration plans | All plans, including Free and Pro | [Plan updates](https://slack.com/help/articles/39264531104275-Updates-to-feature-availability-and-pricing-for-Slack-plans) |
| 2FA setup window | 24 hours, then signed out | [Mandatory 2FA](https://slack.com/help/articles/212221668-Mandatory-workspace-two-factor-authentication) |
| Block SMS for 2FA | Authenticator apps only (paid plans) | [Mandatory 2FA](https://slack.com/help/articles/212221668-Mandatory-workspace-two-factor-authentication) |
| MFA with SSO | Set up in the identity provider | [Mandatory 2FA](https://slack.com/help/articles/212221668-Mandatory-workspace-two-factor-authentication) |
| Domain verification | DNS TXT record; up to 72 hours to take effect | [Claim domains](https://slack.com/help/articles/5513043606547-Claim-and-verify-email-domains) |
| Turn on EMM | Support request to Slack | [Enable EMM](https://slack.com/help/articles/115002579426-Enable-Enterprise-Mobility-Management-for-your-organization) |
| Required AppConfig keys | OrgDomain and ApprovedDevice | [Enable EMM](https://slack.com/help/articles/115002579426-Enable-Enterprise-Mobility-Management-for-your-organization) |

## Check yourself

- Why won't a seven-day session duration flood the service desk on one day?
- When should MFA be enforced in the identity provider instead of Slack?
- Which two AppConfig keys does Slack for EMM require?
- How does an org prove it owns an email domain before restricting it?

## Sources

- [Manage session duration](https://slack.com/help/articles/115005223763-Manage-session-duration)
- [Mandatory workspace two-factor authentication](https://slack.com/help/articles/212221668-Mandatory-workspace-two-factor-authentication)
- [Claim and verify email domains](https://slack.com/help/articles/5513043606547-Claim-and-verify-email-domains)
- [Enable Enterprise Mobility Management for your organization](https://slack.com/help/articles/115002579426-Enable-Enterprise-Mobility-Management-for-your-organization)
- [Maximize Access & Security in Slack](https://trailhead.salesforce.com/content/learn/modules/identity-management-in-slack/explore-access-and-security-controls)
- [Slack plans and features](https://slack.com/help/articles/115003205446-Slack-plans-and-features)
- [Updates to feature availability and pricing for Slack plans](https://slack.com/help/articles/39264531104275-Updates-to-feature-availability-and-pricing-for-Slack-plans)
- [Set up SAML single sign-on for Slack](https://slack.com/help/articles/203772216-Set-up-SAML-single-sign-on-for-Slack)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 7 linked practice questions, and unlimited timed mock exams are included with the Slack Consultant pack (USD $19): https://www.certifyforce.com/practice-exams