Governance, Security and Compliance22% of the exam
Session duration, 2FA and sign-in security
How to turn a security policy into Slack settings: desktop and mobile session duration, mandatory two-factor authentication and lockout recovery, 2FA under SSO, invitation approval, and where to get Slack's SOC 2 report.
Given a scenario, determine how to configure security policies.
~8 min read · 12 practice questions ·
What the exam expects
- Configure desktop and mobile session duration separately, including sign-out when Slack closes and warnings before sign-out, and explain how a change rolls out.
- Use the session duration API on an Enterprise org when one group needs a different session length from the org setting.
- Turn on mandatory 2FA (with Authenticator apps only when SMS is not allowed), predict what happens to existing people and new invitees, check who has 2FA and restore access for someone locked out.
- Know that 2FA for SSO sign-in is set up in the identity provider and that deleting an SSO configuration signs people out.
- Control who joins with invitation approval and periodic invitation reviews, and send auditors to the compliance portal for Slack's SOC 2 report.
Key terms:
- Session duration: how long a member stays signed in on desktop or mobile before Slack asks them to sign back in.
- Mandatory 2FA: the setting "Require members to have 2FA set up" under Two-factor authentication for email sign-in.
- Enterprise org: an Enterprise organization (Enterprise Grid or Enterprise+ plan); its settings live in Organization settings, while Free, Pro and Business+ use Admin > Workspace settings.
- SSO configuration: the identity provider (IdP) connection that signs members in with SAML.
Key facts
Session duration plans
- Detail
- All plans; new on Free and Pro in 2025
Session warnings
- Detail
- Two hours before expiry, final reminder 15 minutes before; desktop setting only
Rollout of a change
- Detail
- Starts the day it is saved; sessions end randomly over the chosen timeframe
Per-group session length
- Detail
- Session duration API, Enterprise plans, shorter or longer than the org setting
Mandatory 2FA deadline
- Detail
- Not set up within 24 hours: signed out until 2FA is set up
No SMS codes
- Detail
- Authenticator apps only, paid plans
Owners and admins
- Detail
- Must use 2FA on paid plans even without mandatory 2FA
Locked-out Workspace Owner
- Detail
- Only the Workspace Primary Owner can turn off their 2FA
Deleting an SSO configuration
- Detail
- Logs out all members signed in with that IdP
SOC 2 report
- Detail
- compliance.salesforce.com, Login with Slack
- Why might members be signed out on the same afternoon an admin sets a seven-day session duration?
- When should an Enterprise org use the session duration API instead of the org setting?
- Why does turning on Slack's mandatory 2FA not add a factor for members who sign in with SSO?
- Where does a Workspace Admin in an Enterprise org check which members have 2FA?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Slack Administrator pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 32 lessons of the Slack Administrator guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (12 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams