> ## Documentation Index
> Fetch the complete documentation index at: https://help-empuls.xoxoday.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Session management

> Configure session token expiry, concurrent login limits per platform, and force-logout-all for Empuls accounts.

Session management controls how long an Empuls sign-in stays valid, how many simultaneous sessions a user can hold across platforms, and how to invalidate sessions when needed. Empuls issues encrypted JWT tokens backed by Redis-stored sessions; you tune their lifetime and concurrency rules here. This is a sub-page of [security settings](/admin/security/security-settings).

## Before you start

* You must be a **Super Admin**.
* Tightening session rules invalidates ongoing sessions — communicate the change before applying org-wide.
* Session rules interact with [password policy](/admin/user-authentication/password-policies) and [SSO](/admin/user-authentication/sso-overview) — review all three together.

## What you can configure

### Session token expiry

Empuls's auth token has a default lifetime; idle sessions are revoked after this period. Configure separately per platform:

| Platform         | Default                | Common values                   |
| ---------------- | ---------------------- | ------------------------------- |
| **Web**          | 8 hours                | 1h (high-security), 4h, 8h, 24h |
| **Mobile**       | 30 days                | 7d, 14d, 30d                    |
| **MS Teams app** | Inherits Teams session | Not directly configurable       |
| **Slack app**    | Inherits Slack session | Not directly configurable       |

Tokens are JWTs signed with RS256 and encrypted using ECDH-ES, so even if a token is exfiltrated it can't be replayed against a different tenant.

### Concurrent login limits

Cap how many simultaneous sessions a user can hold:

* **Global maximum** — Total active sessions across all platforms (default unlimited).
* **Per-platform maximum** — Different cap for web vs mobile (e.g., 2 web sessions, 3 mobile sessions).

When a user signs in beyond the cap, Empuls invalidates the oldest session. Useful for high-security tenants that want to limit account sharing.

### Blocked platforms

Optionally disable login from specific platforms entirely:

* **Web only**
* **Mobile only**
* **Web + mobile only** (no MS Teams or Slack)
* **All platforms allowed**

Useful for offline-period enforcement or compliance scenarios where one platform doesn't meet policy.

### Session duration override (per company)

For tenants serving multiple companies (rare in standard Empuls deployments), you can override session duration per company.

## Configure session rules

<Steps>
  <Step title="Open Session Management">
    Navigate to **Admin Hub → Platform Settings → Security → Session Management**.
  </Step>

  <Step title="Set token expiry per platform">
    Enter values in hours (web) or days (mobile). Set 0 to use defaults.
  </Step>

  <Step title="Set concurrent login limits">
    Enter the global maximum and per-platform maximums. Leave blank for unlimited.
  </Step>

  <Step title="Toggle blocked platforms">
    Check any platforms you want to block.
  </Step>

  <Step title="Save">
    Rules apply on the next sign-in. Active sessions are not invalidated (use force-logout for that).
  </Step>
</Steps>

## Force logout all sessions

For immediate enforcement after a policy change, or in response to a security incident:

<Steps>
  <Step title="Open the Sessions sub-tab">
    Stays in Session Management; switch to **Active Sessions**.
  </Step>

  <Step title="Click Force logout all">
    A confirmation dialog explains the impact — all users sign back in on next page load.
  </Step>

  <Step title="Confirm">
    Empuls invalidates every active session. Users see the sign-in page on their next request.
  </Step>
</Steps>

You can also force-logout an individual user from their record on [Manage employees](/admin/user-management/manage-employees) — Action menu → **End all sessions**.

## Token tracking and proxy logins

Sessions tied to admin [Login As](/admin/user-management/user-delegation) (impersonation) are tracked separately. The admin's own session and the impersonation session both have unique IDs; ending one doesn't affect the other.

For diagnostics, the Active Sessions table shows:

* User
* Platform (web, mobile, teams, slack)
* IP address
* Started at
* Last activity
* Session ID (truncated)

## Limits and gotchas

* Setting a very short web session (e.g., 30 minutes) significantly increases sign-in friction. Pair with SSO to soften.
* Empuls's session storage is in Redis. Brief Redis hiccups can transiently look like session failures — the system retries automatically.
* Concurrent login limits trigger oldest-session eviction, not denial. New sign-ins always succeed; old ones get kicked.
* Per-company session overrides require a support request to configure.

## Related

<CardGroup cols={2}>
  <Card title="Security settings" href="/admin/security/security-settings">
    Other security controls.
  </Card>

  <Card title="SSO overview" href="/admin/user-authentication/sso-overview">
    Federation typically inherits the IdP's session lifetime.
  </Card>

  <Card title="Login As" href="/admin/user-management/user-delegation">
    Admin impersonation that creates a separate tracked session.
  </Card>

  <Card title="Password policies" href="/admin/user-authentication/password-policies">
    Pair with session rules.
  </Card>
</CardGroup>