Introducing Idle Session Timeout in SharePoint and OneDrive (Preview)

There’s a new culture of work; one that is increasingly diverse, geographically distributed, and mobile.  Connectivity is ubiquitous and the ability to work remotely has become an ingrained part of the work practice. People have come to expect to be able to access email and documents from anywhere on any device – and for that experience to be seamless, among these trends includes the increasing use of shared systems, such as kiosks to access and work with corporate data.  In order to help safeguard your information on these systems, we’re introducing new idle session timeout policies rolling out as preview on November 6, 2017 and changes to the “Keep me signed in” experience with Office 365.

Idle session timeout provides an Office 365 administrator to configure a threshold at which a user is warned and subsequently signed out of SharePoint or OneDrive after a period of inactivity as illustrated below.

 

Demo

The demonstration below illustrates the idle session timeout policy enacted on a site that is also configured with site-scoped limited access policies.

Idle session timeout policies allow Office 365 administrators to automatically sign out inactive sessions preventing the overexposure of information in the event a user leaves a shared system unattended.

NOTE

Idle session timeout takes a dependency on the Keep me signed in signal.  In scenarios where Keep me signed in is selected at authentication, the client will not honor the idle session timeout. 

In addition to the new idle session timeout policy we’re rolling out in preview, in late September we updated the keep me signed in experience, replacing the “Keep me signed in” checkbox that appears on the sign-in flow with a prompt that shows after the user successfully signs in.  Idle session timeout interprets this signal and where selected does not affect the client where “Keep me signed in” has been selected, on devices where “Keep me signed in” is not selected, the policy applies.

In addition to those recent changes, we’re also adding a layer of protection to intelligently hide this prompt if we detect a shared device, or a high-risk sign-in. Our goal is to decrease the number of times users are prompted to authenticate. Although the new screen adds a small amount of friction up front, users get a better long-term experience as they get less sign-in prompts when they use our services.

This prompt asks the user if they would like to remain signed in. Responding “Yes” to this drops a persistent refresh token, the same behavior as when the user checks the old “Keep me signed in” checkbox.

For federated tenants, this prompt will show after the user successfully authenticates with the federated identity service. Some things to consider: – During the Public Preview period of the new sign-in experience, this new “Keep me signed in” prompt will only show when users opt-in to the new sign-in experience. Users using the old experience will continue to see the checkbox and will not get the prompt. – You can choose to hide this new prompt for your users by using the “Show option to remain signed in” setting in company branding. Existing configurations of this setting will carry forward, so if you previously chose to hide the “Keep me signed in” checkbox on your tenant, we won’t show the new prompt to your users. – This change will not affect any token lifetime settings you have configured.

Configuring Idle Session Timeout

Idle-session timeout is configured using Windows PowerShell.

Before you get started using PowerShell to manage SharePoint Online, make sure that the SharePoint Online Management Shell is installed and you have connected to SharePoint Online.

Install the SharePoint Online Management Shell by downloading and running the SharePoint Online Management Shell. You only need to do this once for each computer from which you are running SharePoint Online PowerShell commands.

To open the SharePoint Online Management Shell command prompt, from the Start screen, type sharepoint, and then click SharePoint Online Management Shell.

To connect to SharePoint Online with a username and password run the following commands at the SharePoint Online Management Shell command prompt:

Connect-SPOService -Url https://<Tenant>-admin.sharepoint.com

To configure idle-session timeout run the following commands at the SharePoint Online Management Shell command prompt:

Set-SPOBrowserIdleSignOut -Enabled $true -WarnAfter (New-TimeSpan -Seconds 1200) -SignOutAfter (New-TimeSpan -Seconds 1500)

Where:

-Enabled specifies whether idle session timeout is enabled or disabled using $true, $false respectively.

-WarnAfter specifies the amount of after which a user is notified that they will be signed out after a period of inactivity as a New-TimeSpan which can be configured in seconds, minutes, or hours.

-SignOutAfter specifies the amount of time after which is a user is signed out of Office 365 if they do not respond to the -WarnAfter prompt.

To view the idle browser sign-out settings, use the Get-SPOBrowserIdleSignOut cmdlet.

NOTE

  1. Mouse movement or scrolling up and down is not included as activity. Activity is counted as requests sent to SharePoint Online.  Mouse clicks within the context of a site are considered activity.
  2. Idle-session timeout is limited to SharePoint Online browser sessions; however, will sign users out of all Office 365 workloads within that browser session.
  3. It will not sign out users who are on managed devices or select Keep Me Signed In during sign-in.
  4. Idle session timeout is currently limited to Classic sites.  A fix will be rolled out to support Modern sites soon.
  5. The WarnAfter and SignOutAfter values cannot be the same.
  6. The policy scope is Tenant-wide.

Frequently Asked Questions

When will idle session timeout start rolling out as preview?

November 6, 2017

Is idle session timeout enabled by default, can I control the settings?

No.  Idle session timeout is disabled by default.  The warning and timeout timespans, as well as enabling idle session timeout are administrator controlled.  Instructions will follow as we start to roll out this feature.

Does the policy effect existing signed in sessions?

No, only new sign-ins to new browsers

How long does it take to effect?

Approx. 15 minutes

What is considered a managed device?

A device is managed if Azure Active Directory indicates to SharePoint Online that the device state was evaluated and the device is at least one of the following:

  • Domain joined
  • Compliant

Device state claims are not passed in Google Chrome or when using inPrivate mode – device claims are only available on Internet Explorer or Microsoft Edge on Microsoft Windows.

Can I hide the Keep me signed in prompt?

During the public preview period of the new sign-in experience, the updated “Keep me signed in” prompt will only show when users opt into the new sign-in experience. Users using the old experience will continue to see the checkbox and will not get the prompt.

Admins can choose to hide this new prompt for users by using the “Show option to remain signed in” setting in company branding.

NOTE 

Existing configurations of this setting will carry forward, so if you previously chose to hide the “Keep me signed in” checkbox in your tenant, we won’t show the new prompt to users in your tenant.

This change won’t affect any token lifetime settings you have configured.

When will idle-session timeout be generally available?

April 2018

Office 365 Data Loss Prevention Block Access with SharePoint and OneDrive

Last week we announced Office 365 Data Loss Prevention Block Access (https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Policy-Tips-in-SharePoint-Online-and-OneDrive-for-Business-at/ba-p/116158) with SharePoint Online and OneDrive for Business.  Office 365 Data Loss Prevention Block Access prevents the potential for overexposure of sensitive information by allowing a Tenant administrator to configure Data Loss Prevention Policies limiting how and with whom sensitive information can be shared.

For example, if a document is determined to contain sensitive information, for example U.S. Financial Data, a DLP policy can prevent that information from being shared externally or with guests while providing real-time policy information to the user attempting to initiate the share.

Users are presented with a Policy Tip when viewing information about the document in addition to the option to view the specific policy that limits sharing of the document.

In addition, if the user attempts to share content that violates the policy configuration, they are notified at the time of sharing with a Policy Tip and link to additional information.

Configuring Office 365 Data Loss Prevention Block Access policies in the Security and Compliance Center

To configure Office 365 Data Loss Prevention Block Access policies browse to https://protection.office.com/, and expand Data loss prevention.

Under Data loss prevention select Policy.

Select Create new policy to create a policy and choose from one of the available templates.

Provide a Name and Optional description of the policy and click Next.

Select one or more locations to protect and click Next.

Under Policy settings select Detect when this content is shared: and choose With people outside of my organization and click Next.

On the What do you want to do if we detect sensitive info? dialog select Restrict who can access to the content and override the policy and click Next.

Optionally you can configure additional settings for the policy such as:

  • The ability to block specific people from accessing sensitive content that meets the criteria of the policy.
  • Allowing policy override with or without business justification.

Click Next to save the policy settings.

On the Review your settings page, click Create to save and apply the policy.

Configuring Existing DLP Policies

In addition to the creation of new policies, a Tenant administrator can use Windows PowerShell to configure existing data loss prevention policies for block access.

To update one or more existing policies, connect to Office 365 Security and Compliance Center PowerShell, refer to the Windows PowerShell example below:

Get-DlpComplianceRule | Where-Object {$_.BlockAccess -eq 'true' -and $_.BlockAccessScope -ne 'PerUser' -and $_.AccessScope -eq 'NotInOrganization' -and $_.NotifyUser -ne ''} | Set-DLPComplianceRule -BlockAccessScope 'PerUser'

NOTE

The script above will turn any DLP policy rules that previously blocked everyone (except Last Modifier, Owner, and Site Administrator) into a rule that only blocks access to external users.

Resources

To learn more about data loss preventions policies in Office 365 visit Overview of data loss prevention policies at https://support.office.com/en-us/article/Overview-of-data-loss-prevention-policies-1966b2a7-d1e2-4d92-ab61-42efbb137f5e.

Security at the Site-Collection Level in SharePoint Online

Balancing security and usability are core to ensuring people can collaborate effectively without interrupting the necessary flow of information across organizations.  With SharePoint Online we’ve been at work developing security and sharing controls that are scoped at the site collection level.  This allows Tenant administrators to configure more restrictive controls at the site collection level, than those that are configured at the Tenant level providing a balance between the need to protect corporate information and the requirement to collaborate effectively across and outside of the corporate boundary.

Site Collection Controls

Restricted Domain Sharing Controls

With SharePoint Online sites can be shared with users from specific domains by using the restricted domains setting. This is useful for a business-to-business extranet scenario where sharing needs to be limited to a particular business partner or external user.

Administrators can configure external sharing by using either the domain allow list or deny list. This can be done at either the tenant level or the site collection level. Administrators can limit sharing invitations to a limited number of email domains by listing them in the allow list or opt to use the deny list, listing email domains to which users are prohibited from sending invitations.

To configure restrict domains in external sharing in SharePoint Online at the site collection level:

  1. From the SharePoint Admin Center, select the site collections tab.
  2. Select a site collection, and then click Sharing.
  3. Under Site collection additional settings, select the Limit external sharing using domain check box.
  4. From the drop-down list, choose either Don’t allow sharing with users from these blocked domains to deny access to targeted domains or Allow sharing only with users from these domains to limit access to only to the domains you list.
  5. List the domains (maximum of 60) in the box provided, using the format domain.com.. If listing more than one domain, separate each domain with a space or a carriage return.

Site-Scoped Conditional Access Policies

New to SharePoint Online are site-scoped conditional access policies.  Device-based policies for SharePoint and OneDrive in help administrators ensure data on corporate resources is not leaked onto unmanaged devices such as non-domain joined or non-compliant devices by limiting access to content to the browser, preventing files from being taken offline or synchronized with OneDrive on unmanaged devices at either the Tenant or site collection level.

Site-scoped device-based access policies can be configured with SharePoint Online Management Shell.

Before you get started using PowerShell to manage SharePoint Online, make sure that the SharePoint Online Management Shell is installed, and you have connected to SharePoint Online.

NOTE

The Tenant-level device-based policy must be configured to Full Access prior to configuring site-scoped policies.

Connect-SPOService -Url https://<URL to your SPO admin center>
$t2 = Get-SPOSite -Identity https://<Url to your SharePoint online>/sites/<name of site collection>
Set-SPOSite -Identity $t2.Url -ConditionalAccessPolicy AllowLimitedAccess

Read more about site-scoped conditional access at https://blogs.technet.microsoft.com/wbaer/2017/10/08/site-scoped-conditional-access-policies-in-sharepoint-online/.

Additional Controls

Allow users to Invite new partner users:    In certain site collections, admins can optionally allow users to invite new partner users. In this model, an email invite is sent to the partner user and the user must redeem that invite to access the resource. See Manage external sharing for your SharePoint Online environment for details.

Sharing by site owners only:    Ability to have site collections where only site owners can bring in or share with new users. Site members, who are typically external partner users, can see only the existing site members in the site. This helps in governing what partners can see and with whom they can share documents.

To learn more about security and compliance with SharePoint and OneDrive:

Accessibility in SharePoint Online

There are no limits to what people can achieve when technology reflects the diversity of everyone who uses it. We believe in what people make possible – at Microsoft, our mission is to empower every person and every organization on the planet to achieve more.

Across SharePoint and OneDrive our most important work is making our technology accessible to people of all abilities. Over the past several months we’ve been working towards this vision with improvements across how and where people collaborate ensuring our experiences both create and support opportunities for everyone.

Site Improvements

  • Navigate through the major portions of the page using reserved tab stops.
  • Take advantage of the new accessible SharePoint Online page authoring experience for edit and view your home page.
  • Proper field types and labels that provide details to screen reader users on what each field is and how to use it.

List and Library Improvements

  • Keyboard shortcuts for all major list functions, including a shortcut (SHIFT+F10) for the details menu. Press the question mark “?” to browse the full list of shortcuts.
  • Up and Down Arrow keys navigate between list items. Left and Right Arrow keys navigate between columns.
  • Action confirmations when you updated list item fields.
  • Focus returns to where you were when you finish working in the list and exit, so you never have to start from the top of the page.

Page Authoring Improvements

  • Landmarks and headings for easy navigation across major areas of the page.
  • Web part focus zones to make it easy to setup and edit a web part. In edit mode, just press Enter to navigate into the web part, then use the Tab and Arrow keys to navigate within the web part.
  • Keyboard shortcuts in the rich text editor allow you to jump to the command bar and execute common text commands such as bold, italics, underline, and so on.
  • Focus automatically goes to the caption field when you add images or video web parts, to encourage you to add alternative text descriptions of the images.
  • Page authoring automatically confirms actions that you take when you update web part properties, use the rich text editor commands, and so on. You never have to question an action again.

To learn more about these and more accessibility features in SharePoint Online refer to the links below:

Accessibility features in SharePoint Online
Accessibility support for SharePoint Online

Microsoft has been very public about our product support for accessibility standards for some time. We broadly publish conformance reports for our products for key accessibility standards such as Section 508, WCAG 2.0 and EN 301 549. In the next few months, we will begin publishing conformance statements with the updated Section 508 regulations recently published by the US Access Board.

In addition to the resources above, hear and see the most recent developments in accessibility from Microsoft Ignite.

Learn how to make SharePoint accessible and inclusive
Did you know that the NEW SharePoint experiences are accessible and inclusive? Come see why you should care about the accessibility best practices we followed while building these experiences on Microsoft SharePoint Online (specific focus on: creating communication sites and modern page authoring) and how your organizations can take advantage of these. Our modern experiences help ensure equal access to information and opportunities for people with disabilities. They address the requirements of Section 508 Standards, WCAG 2.0, Level AA Success …
VIEW MORE >

Ensure productivity for your employees and customers with disabilities with Office 365 accessibility
Discover how you can empower people with a range of vision, mobility, hearing, and cognitive abilities to communicate, consume and create content in their preferred ways and empower everyone to collaborate inclusively using Office 365. Experiences that are accessible by design can boost productivity for people of all abilities – including people with temporary conditions such as hand or eye strains and people with situational requirements such as working without a mouse or monitor on the go. If you are looking to attract and retain talent in yo…
VIEW MORE >

Discover easy ways to make your official communications and content more accessible
With over 1 billion people with disabilities on the planet, it is important to check that your organization’s official content poses no barriers for those who use assistive technologies. Your organization might be required to do this if laws and standards such as EN 301 549, WCAG 2.0 AA and US Section 508 apply to you. Office 365 offers built-in capabilities such as Accessibility Checkers that make it easy to find accessibility issues, and intelligent controls such as Automatic Alt Text that make it efficient to fix accessibility issues. Get in…
VIEW MORE >

Learn strategies to make your IT applications more accessible and usable by people of all abilities
Do you want to ensure all your IT applications are empowering for people with disabilities and compliant with global accessibility standards? Learn how the Office engineering team approached making all Office 365 applications accessible by design in a scalable and sustainable manner – ensuring all engineers create experiences that go beyond minimal compliance to be truly usable by people of all abilities. Inclusive design training, usability studies, documentation, and support methodologies are shared. Also, an overview is given of how a system…
VIEW MORE >

Site-Scoped Limited Access Policies in SharePoint Online

In March 2017 we introduced device-based policies for SharePoint and OneDrive, that enable administrators to configure Tenant-level policies.

Device-based policies for SharePoint and OneDrive help administrators ensure corporate data is not leaked onto unmanaged devices such as non-domain joined or non-compliant devices by limiting access to the content to the browser, preventing files from being taken offline or synchronized with OneDrive.

On September 1st, 2017 we’ve continued to evolve our conditional access investments to address the ever-changing security landscape and business needs by introducing new levels of granularity with conditional access that allow administrators to scope device-based policies at the site collection level.  In addition, this granular policy can be configured to allow users on unmanaged devices to edit Office Online documents in the browser.

In the demonstration above, the Tenant is configured with a permissive device access policy, allowing full access from unmanaged devices to include desktop apps, mobile apps, and browsers.  The Marketing site inherits the policy configured at the Tenant; however, the Legal site has a policy configured less permissive than that configured at the Tenant level.  In addition, members of the Marketing site, while limited to browser only access on unmanaged devices, can continue to edit content they have access to provide a seamless collaborative experience.

Configuring Policies

Once available in First Release Tenants site-scoped device-based access policies can be configured with SharePoint Online Management Shell.

Before you get started using PowerShell to manage SharePoint Online, make sure that the SharePoint Online Management Shell is installed and you have connected to SharePoint Online.

NOTE

The Tenant-level device-based policy must be configured to Full Access prior to configuring site-scoped policies.

  1. Connect-SPOService -Url https://<URL to your SPO admin center>
  2. $t2 = Get-SPOSite -Identity https://<Url to your SharePoint online>/sites/<name of site collection>
  3. Set-SPOSite -Identity $t2.Url -ConditionalAccessPolicy AllowLimitedAccess