About "Unusual login attempts on your atlassian account"

[青山 明]

Yesterday, I received an email from Atlassian with the following message.
"Unusual login attempts on your Atlassian account"

I understand that someone else may have tried to log in.
When I checked the site below, I found that the session from 10 days ago was still there. (I think I logged in)
Could this be the cause?
Also, will the previous session remain for 10 days?
https://id.atlassian.com/manage-profile/security/recent-devices

[Himanshi]

Hello @青山 明 , 

Welcome to the community!

If you don't set idle session duration, we set a default duration of 30 days in the authentication policy. This applies to all the users who have access to your Atlassian products.

To select an idle session duration from an authentication policy:

1. Go to admin.atlassian.com. Select your organization if you have more than one.

2. Select Security > Authentication policies.

3. Select Edit for the policy you want to modify.

4. On the Settings page, select length of time for Idle session duration.

When you save changes to the session duration, users don't get logged out of their accounts. The new idle session duration will apply the next time a user logs in.

You can read about it more from: https://support.atlassian.com/security-and-access-policies/docs/update-idle-session-duration/

If you wish you can logout from all the active sessions, you can refer the steps mentioned in : https://support.atlassian.com/atlassian-account/docs/manage-recently-used-devices-for-your-atlassian-account/

Hope it would help in answering your query. 

Have a great day !

[青山 明]

Thank you for your reply.
However, my organization has not set an authentication policy.
Or is there a default value etc. even if it is not set?

[Himanshi]

Hello @青山 明 , 

Are looking default value for the idle session ?

If yes: Jira set a default duration of 30 days in the authentication policy.

Let me know if this answers your query. :)

[青山 明]

Thank you for your reply.
My organization has not set an authentication policy.
So I think what you say doesn't apply.