Microsoft’s Outlook on the Web to Drop Support for Activity-Based Authentication Timeout

microsoft 365 hero approved

Key Takeaways:

  • Microsoft will discontinue support for activity-based authentication timeout in Outlook on the Web in January 2024.
  • Microsoft advises Outlook users to switch to idle session timeout settings instead.
  • The idle session timeout feature allows IT admins to set a tenant-wide policy specifying the duration of inactivity after which users must re-enter login credentials.

Microsoft is discontinuing support for activity-based authentication timeout in Outlook on the Web. Starting in January 2024, the company will replace the feature with idle session timeout settings for Microsoft 365 commercial customers.

Microsoft introduced the idle session timeout feature for Microsoft 365 Web apps in June 2022. This feature enables IT admins to create a tenant-wide policy that specifies the duration of inactivity, after which end-users need to re-enter their login credentials to access Microsoft 365 Web apps. The supported apps include Word, Excel, Outlook on the Web, OneDrive for the Web, PowerPoint for the Web, Office.com, SharePoint, and Microsoft 365 admin center.

“Idle Session Timeout is already available and provides the same functionality as Activity-Based Authentication Timeout with the benefit of allowing the configuration not only for Outlook on the web, but for a range of other Microsoft 365 web apps,” the company explained in a message on the Microsoft 365 admin center.

Microsoft's Outlook on the Web to Drop Support for Activity-Based Authentication Timeout

How to enable idle session timeout

Microsoft recommends customers to turn on the idle session timeout setting within their tenants. To implement the policy, navigate to the Org setting section of the Microsoft 365 admin center, click the Security & privacy tab, and select Idle session timeout. Finally, choose the default setting or set a custom value.

Once enabled, users will receive a notification one minute before their idle session timeout duration ends, indicating that their session is about to expire. If the user does not take any action within a specific period, they will be automatically signed out of Microsoft 365 web apps.

Overall, the idle session timeout feature is a great way to provide extra security for remote workers who use shared or unmanaged devices. However, it’s important to note that users must configure their web browsers to accept third-party cookies. Additionally, Microsoft Edge users must set their tracking prevention settings to Balanced (default) to use this feature.