Session & inactivity timeouts

Two independent settings decide how long an employee stays signed in to the Virtual Assistant: the session duration (a hard limit measured from sign-in) and the inactivity timeout (an idle limit that resets whenever the employee interacts with the assistant). This page explains what each one does, what employees experience when a session ends, and which parts of the lifecycle Leena AI controls versus your identity provider.

📘

Where to find it

Unified Dashboard → Settings → Global Settings → Authentication (Bot Authentication) → Virtual Assistant

The Mobile / Desktop App channel has its own, near-identical page. Session settings are configured per assistant and per channel — the web Virtual Assistant and the mobile app do not share values, and UAT and Production are configured separately.

---

The two limits at a glance

The inactivity timeout can only shorten a session. It never extends the session duration.

---

How a session works

1. The employee signs in using the method configured for the assistant — SSO, OTP, OAuth, or a custom portal handoff.
2. The assistant issues a short-lived access credential (1 hour by default) alongside a renewal credential.
3. While the employee keeps using the assistant, the access credential is renewed silently in the background — roughly five minutes before it expires. Employees never see this happen, and it does not interrupt an open conversation.
4. The renewal credential has a fixed lifetime set at sign-in, and this is the hard session boundary. Activity does not extend it.
5. When that boundary is reached, the employee is sent back through your sign-in flow.

📘

Why "silent renewal" matters in a security review

The 1-hour rotation is not the session length. It limits how long any single credential is usable, which shortens the window of exposure if a credential is ever compromised, while the employee's working session continues uninterrupted.

---

Session duration (forced re-authentication)

The session duration is counted from the moment of sign-in and cannot be extended by activity. It is a guaranteed re-authentication checkpoint.

What the employee sees

• In the final hour, a banner appears above the chat: "Your session will expire at [time]. Please log out and log in again to avoid work interruption." It includes a Log out button so the employee can re-authenticate at a convenient moment rather than mid-task.
• At expiry, the employee is returned to the assistant's sign-in screen. Any open assistant tabs are signed out at the same time.
• Conversation history is not lost. Chats are stored against the employee's profile and reappear once they sign back in.

👍

Whether they actually see a login prompt is up to your IdP

At the boundary, Leena AI always sends the employee back through your identity provider. If their IdP session is still valid, re-authentication completes silently and the employee experiences little more than a page refresh. If the IdP session has also expired, they see your normal credential or MFA prompt. The session duration is the guaranteed re-authentication interval; the visible login frequency is governed by your IdP.

---

Inactivity timeout

The inactivity timeout is off by default — an idle session stays valid until the session duration is reached. When enabled, you set any duration greater than zero and up to a maximum of 30 days.

What counts as activity. Activity means real interaction with the assistant — typing, clicking, or touch input. Simply leaving the assistant open in a background tab does not keep the session alive; the assistant reports the employee's genuine last interaction time, not the fact that a tab is open.

How quickly it's detected. The assistant reports activity on a rolling interval of every five minutes, or one-tenth of the configured timeout, whichever is shorter. A 10-minute inactivity timeout is therefore evaluated roughly every 60 seconds, so the employee is signed out promptly rather than at their next interaction.

What happens at the threshold. The session is fully revoked — both the access credential and the renewal credential. The session cannot silently resume, and the next interaction requires a complete sign-in through your configured authentication method. All of that employee's open sessions for the assistant are signed out together.

What the employee sees. They land on the assistant's sign-in screen. On kiosk and shared-device deployments, employees are warned first: a Session Timeout dialog appears with a countdown and a "Yes, keep me logged in" option, explaining that sessions automatically end after the configured period of inactivity.

---

What the employee experiences — quick reference

---

What Leena AI controls vs. your SSO / IdP

Controlled by Leena AI (configurable per assistant, no change needed on your IdP):

• Session duration — the forced re-authentication interval
• Access-credential rotation interval
• Inactivity timeout — on/off and duration
• Session lifetime for embedded webviews and tools, renewed against the active session
• Sign-out behaviour — credentials are revoked immediately on logout

Controlled by your SSO / IdP:

• Whether re-authentication at the session boundary is silent or prompts for credentials or MFA — this follows your IdP session lifetime
• MFA policy, password policy, and conditional access rules applied at sign-in

Jointly controlled:

• Who can access the assistant at all. Access can be restricted to employees synced from your HRMS and filtered by access rules. The rule lives on the Leena AI side; the employee data comes from yours.
• Leaver access removal. HRMS deprovisioning blocks access on the Leena AI side at the next validation; disabling the user in your IdP blocks any new sign-in.

📘

The short answer for security reviews

If the goal is shorter or stricter sessions, both levers are on the Leena AI side and can be adjusted per assistant without touching your SSO configuration.

---

Related behaviour worth knowing

• Multiple tabs share one session. Signing out in one tab — or a session ending for any reason — signs the employee out everywhere for that assistant.
• Embedded webviews inherit the session. Workflow forms, tickets, and other in-assistant webviews run on short-lived credentials renewed against the active session. When the session ends, open webviews stop working and return the employee to sign-in.
• Channels are configured independently. Changing the web Virtual Assistant's session settings does not affect the mobile app, desktop app, or chat-platform channels such as Microsoft Teams or Slack, where session lifecycle is largely governed by the host platform.
• Settings take effect at the next sign-in. Existing sessions continue on the values they were issued with.

⚠️

Assistants on the legacy session model

Assistants configured before rotating sessions were introduced run on a single long-lived credential (45 days by default), with no separate rotation interval. On these assistants the session duration cannot be tuned independently until the rotating-session model is enabled — a configuration change your Leena AI team can make for the assistant, with no impact on your SSO setup.

---

Requesting a change

• Inactivity timeout — enable it and set the duration yourself on the Virtual Assistant authentication page, provided you hold the Authentication permission.
• Session duration and rotation interval — raise the target values with your Leena AI contact. These are set per assistant and per environment.

Validate any change in UAT before applying it to Production, and give employees advance notice when you shorten sessions significantly — a tighter limit means more frequent sign-ins, and how visible those are depends on your IdP session policy.

---

Related pages

• Virtual Assistant (Bot Authentication) — authentication methods, allowed domains, and multi-IDP routing
• Dashboard Authentication — sign-in for dashboard users, configured separately from end users
• Login Screen — what employees see when they sign in
• Setup Employee Sync — how HRMS sync governs who can access the assistant