Web apps should sign out idle users on unmanaged devices within three hours

People leave browsers open on personal computers, shared machines and kiosks. If the session stays signed in, whoever sits down next has the user's mail, files and chats. An idle timeout closes that window by signing the user out after a period with no activity.

Microsoft describes the feature in Idle session timeout for Microsoft 365. It applies to web apps such as Outlook on the web, SharePoint and OneDrive. Limiting the policy to unmanaged devices keeps managed company devices free of extra prompts.

In the Microsoft 365 admin center go to Settings, Org settings, Security & privacy, Idle session timeout. The page shows whether the setting is on and the chosen time.

The SharePoint side can be read with PowerShell, which does not change anything:

Connect-SPOService -Url https://CONTOSO-admin.sharepoint.com
Get-SPOBrowserIdleSignOut

The output shows Enabled, WarnAfter and SignOutAfter. To see which sessions the timeout applies to, list your Conditional Access policies in Microsoft Entra admin center, Protection, Conditional Access, and look for a policy that targets unmanaged devices with the app enforced restrictions session control.

In the admin center open Idle session timeout, turn it on and choose a period of three hours or less. If you want it to apply to unmanaged devices only, follow the Microsoft Learn article above: create a Conditional Access policy for the Office 365 apps with the device filter or compliance condition for unmanaged devices and the app enforced restrictions session control.

The SharePoint timeout can also be set from PowerShell; replace the example times with your own:

Set-SPOBrowserIdleSignOut -Enabled $true `
  -WarnAfter (New-TimeSpan -Minutes 150) `
  -SignOutAfter (New-TimeSpan -Hours 3)

Test with a pilot group first. ConfigCobra only reads this setting; it never changes your tenant.

Users on unmanaged devices, such as personal laptops and shared computers, are warned and then signed out of Microsoft 365 web apps after the idle period, and have to sign in again. Unsaved work in a web document can be lost if they ignore the warning, so tell people before the change.

Users on managed devices are not affected when the policy is scoped to unmanaged devices. Helpdesk may see more sign-in questions in the first week.