DUO is not being triggered every 14 days

[Bob Sochacki]

We setup our DUO cloud instance to have the certificate live for 14 days so users will regularly get prompted for MFA.  Users are not getting prompted every 14 days to authenticate with DUO.  If they logout it happens consistently.   

Wondering if there is a setting we are missing?  

Thanks! 

[Petter Gonçalves · Accepted solution]

Hello @Bob Sochacki

Welcome to the Atlassian Community!

Per your description, I understand the two-factor authentication you configured with DUO is not being triggered in the time you stipulated unless the user selects to logout from his account. Is that correct?

It is expected behavior that the two-factor authentication is not triggered if the user still has a logged session in the Cloud site. That being said, please follow the steps of the documentation below to set a timeout limit to drop out the session and enforce the two-factor authentication with DUO:

Session duration management 

Basically, the steps are:

1. Access your organization at admin.atlassian.com and click Security (at the header of the page) > Session duration.

2. From the Idle session duration dropdown, select the amount of time you want.

P.S: The steps mentioned in the documentation above are only applicable to your Managed accounts.

Let us know if you have any questions.

[Bob Sochacki]

Petter, that is correct.  I will have our admin take a look at this setting and if not set take care of it. 

[Bob Sochacki]

According to Jira documentation: A session is idle when users don’t interact with the product during that period of time. Interactions can be active (a user clicks a button) or passive (an open page auto refreshes).

Do most pages refresh regularly to check for updates or only if there is an update?  So, if there is no activity over a weekend, then we could set it to 36 hours and that would force a logoff?   

Trying to determine how to not annoy the users while at the same time prompting regular MFA for users.   

[Petter Gonçalves]

Hello @Bob Sochacki

Usually, an open page does not update itself without the action of the user if he is not currently visualizing it. The only thing that would not follow this behavior would be if you have any automation rule that could trigger an action from the user.

That being said, if you set your session to timeout after being idle for 36 hours, it might drop your user's session during the weekend.

I suggest testing what would better work for your team, once this is a setting that can be easily changed if any annoyance is applied.

Let us know if this information helps.

[Bob Sochacki]

Last week, the idle time out was set to 8 hours.  On Monday, I clicked on my bookmark for Jira.  I was still logged in.  We are using Azure AD Integration with Jira.  I queried about 10 users.  Only the Admin who set the idle time was logged out on Monday and Today.   

I was going to logout, log back in, exit all browsers before I complete my day and see what happens in the AM.  

Any suggestions? 

[Petter Gonçalves]

Hello @Bob Sochacki

Sorry for my late reply, I only received your notification that the answer was accepted.

Were you able to properly address the root cause of the ignored idle time? Can we help you with anything else?

[Bob Sochacki]

Petter, no worries.  I was not able to resolve this.  I am not sure if there is anything else we can look at.  I am wondering if this is no somehow tied to an Azure setting. 

[Petter Gonçalves]

Hey Bob,

I would say that it's possible that an azure setting or browser extension is refreshing your session.

As a final test, you could create a separate account (using Gmail, Hotmail, etc) and log in with this account in incognito mode, checking if the same behavior happens and then eliminating each of the possible reasons (Browser extensions, Azure settings, etc).

[Bob Sochacki]

@Petter Gonçalves is logout required for idle time to kick in?