Policies and Settings22% of the exam
Session duration, 2FA, domain claiming and EMM
The org-level security settings a consultant walks a client through: how session duration changes roll out and when to use the session duration API, mandatory 2FA versus MFA in the identity provider, claiming domains to block external workspaces, and turning on Enterprise Mobility Management with the required AppConfig keys.
Guide clients through key org-level security settings.
~7 min read · 7 practice questions ·
What the exam expects
- Explain how a session duration change rolls out and recommend the session duration API for a subset of members.
- Plan a mandatory 2FA rollout (24-hour window, authenticator apps only) and know when MFA belongs in the identity provider instead.
- Recommend domain claiming to stop employees joining external workspaces with the company domain.
- Describe how EMM is turned on, which AppConfig keys are required, and what to tell members.
Key terms:
- Session duration: how long members stay signed in before they must reauthenticate, set separately for desktop and mobile.
- Mandatory 2FA: Slack's own second factor for email-and-password sign-in.
- Domain claiming: proving ownership of an email domain with a DNS TXT record so Slack can restrict how that domain is used.
- EMM: Enterprise Mobility Management, which limits Slack access to managed apps and devices.
Key facts
Session duration rollout
- Detail
- Starts that day, sessions end randomly over the chosen timeframe
Expiry warnings
- Detail
- Two hours before, final reminder 15 minutes before
Different duration for a subset
- Detail
- Session duration API, Enterprise plans
Session duration plans
- Detail
- All plans, including Free and Pro
2FA setup window
- Detail
- 24 hours, then signed out
Block SMS for 2FA
- Detail
- Authenticator apps only (paid plans)
MFA with SSO
- Detail
- Set up in the identity provider
Domain verification
- Detail
- DNS TXT record; up to 72 hours to take effect
Turn on EMM
- Detail
- Support request to Slack
Required AppConfig keys
- Detail
- OrgDomain and ApprovedDevice
- Why won't a seven-day session duration flood the service desk on one day?
- When should MFA be enforced in the identity provider instead of Slack?
- Which two AppConfig keys does Slack for EMM require?
- How does an org prove it owns an email domain before restricting it?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Slack Consultant pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 38 lessons of the Slack Consultant guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (7 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams