Profile & Sessions
Choose how long you stay signed in and which page opens first, see every device you're signed in on, and sign any of them out. Administrators also set the session policy, sign people out after a period of inactivity, and end any session in the organization.
Requires role: Viewer (your own profile and sessions) / Admin (the session policy, the Sessions page, and ending other people's sessions)
Related: User Management & RBAC, Security Architecture, License Enforcement, Operator Identity Resolution
Overview
Every sign-in creates a session that the server tracks. That gives you four things:
- Signing out ends the session on the server. A copied cookie stops working at once, even on a shared machine.
- You choose how long you stay signed in, up to a maximum your administrator sets.
- You can see and sign out every device you're signed in on. An administrator's role change or removal ends a person's sessions at once.
- Administrators can sign people out after a period of inactivity, and end any session in the organization from one page.
This guide covers the Profile & sessions page (every signed-in user), and the Session policy card and Sessions page (administrators).
Prerequisites
- You're signed in. Every signed-in user can manage their own profile and sessions.
- The Admin role, to set the session policy and end other people's sessions.
The Profile & Sessions Page
Getting There
- Select your name or avatar at the top right of the page.
- Select Profile & sessions.
The page is yours alone. It isn't in the sidebar, and an administrator can't change anything on it for you. The only limits come from the session policy.
Identity Card
The top card shows your name, your role, your email, and Signs in with: the identity provider you signed in through.
The Linked directory account row shows the directory account your sign-in matches. See Operator Identity Resolution.
Preferences
Stay Signed In For
This sets how long a sign-in lasts before you sign in again.
- Open the Stay signed in for list.
- Choose 1, 4, 8, 12 or 24 hours. The list offers only durations up to your administrator's maximum, and marks the platform default with "(default)".
Your choice saves at once. The line under the list states the maximum, for example "Your administrator allows up to 24 hours."
IMPORTANT
The change applies the next time you sign in. It doesn't change the session you're using now. To use it right away, sign out and sign in again.
If your administrator lowers the maximum below your choice, your choice is kept but capped at the new maximum when you next sign in. The list then shows it with "(current)".
Start Page
Choose the page that opens when you sign in: Dashboard, Graph Explorer, Critical Junctions, Detection Alerts, Identity Inventory, Investigations, Security Posture, Delegation Risk, Bridges or Graphne. The default is Dashboard.
Active Sessions
This card lists every device signed in as you: a browser on your laptop, a browser on your phone, or any other sign-in.
Each row shows:
- The browser and device, read from the browser's user agent. Hover for the full string.
- The IP address it last connected from.
- Signed in: when the session started.
- Last active: how long ago the device last made a request. It updates at most once a minute.
- Last interaction, when sign out after inactivity is on. See Last Interaction.
- A This device badge on the session you're using now, or a Sign out button on every other row.
Signing Out One Device
Use this to end one sign-in, for example on a shared computer or a browser you no longer use.
- Find the session in Active sessions.
- Select Sign out on its row.
- In Sign out this device?, select Sign out.
That device is signed out at once. Its next request goes to the sign-in page, which says "You were signed out because your session ended."
Signing Out Everywhere
Use this if you think a device is compromised, or you aren't sure which sessions are still open.
- Select Sign out everywhere at the top of Active sessions.
- Confirm. The dialog says it includes the device you're using now.
Every one of your sessions ends, this one included, and the sign-in page opens.
Session Policy (Administrators)
Requires role: Admin. Operators and Viewers don't see this card.
The session policy bounds everyone's Stay signed in for choice, and sets when inactive people are signed out.
Getting There
- Select Admin > Users in the sidebar.
- Scroll to the Session policy card, below the users table. View sessions on the card opens the Sessions page.
Configuring the Policy
The card has three settings:
| Setting | What it sets | Choices |
|---|---|---|
| Default sign-in duration | The duration for anyone who hasn't chosen their own. Starts at 12 hours. | 1, 4, 8 or 12 hours, or 1, 2, 3 or 7 days |
| Maximum sign-in duration | The longest anyone can choose. Starts at 24 hours. | The same choices. The platform never allows more than 7 days. |
| Sign out after inactivity | How long a session can go without real interaction before it ends. Starts at Never. | Never, 5, 15 or 30 minutes, or 1, 2, 4, 8 or 24 hours |
The default can't be longer than the maximum. If you choose a longer default, Save stays disabled and the card says why.
Select Save to apply your changes.
IMPORTANT
The durations and the inactivity setting apply differently. A duration change applies to new sign-ins only. Anyone signed in keeps their current duration until it ends. The inactivity setting applies at once, to everyone signed in now. To end sessions right away after tightening the durations, end them on the Sessions page.
Sign Out After Inactivity
This setting ends a session once nobody has used it for the time you choose. Use it for shared workstations, unattended admin consoles, or anywhere an unlocked screen is a risk.
- Open the Sign out after inactivity list on the Session policy card.
- Choose a time, or Never to turn it off.
- Select Save.
Before you save, the card says what the change will do:
| Change | What the card tells you |
|---|---|
| Turning it on (from Never) | "Turning this on signs nobody out. Everyone signed in now gets the full [time] from the moment you save." |
| Choosing a shorter time | The shorter time applies right away, and anyone idle longer is signed out on their next request. |
| Turning it off (to Never) | "Nobody is signed out for inactivity while this is set to Never." |
| A longer time, or no change | An "On since" line with the date and time it was last turned on. |
IMPORTANT
Turning this on signs nobody out. Everyone signed in gets a full window, measured from the moment you save. A shorter time is the one change that takes effect at once: anyone idle for longer is signed out on their next request.
Changing one time to another never restarts anyone's clock. Turning the setting off and on again does, because turning it on starts everyone's window afresh. To sign out every idle session at once, use the Sessions page instead.
Every open browser tab picks up a new or changed time by itself, without a reload, within about a minute of its next interaction.
What counts as interaction. Only a person's input keeps a session alive: a key or mouse button press, a tap, scrolling with a mouse wheel or touchscreen, or switching back to a background tab. Requests a page makes by itself, such as refreshing data, never count. A tab left open on an empty desk is signed out on time, even while it keeps polling for updates.
While your license is expired or missing, you can't save the session policy, inactivity setting included. Everything else keeps working: an inactivity time you already set is still enforced, and administrators can still end sessions on the Sessions page. See License Enforcement.
Ending a Person's Sessions
To end every session of a departing or compromised person, open the Sessions page. Search for them, select their sessions, and select End sessions.
Changing their role or removing them on Admin > Users also ends their sessions, automatically:
- A role change, on their own entry or a group they belong to, ends their sessions at once. Their next request is refused, and they sign in again with the new role.
- Removing a person, or a group that gave them access, ends their sessions the same way.
Sessions Across Your Organization (Administrators)
Requires role: Admin. Operators and Viewers can't open this page or end anyone else's sessions.
The Sessions page lists every active and recently ended session of every person in the organization. You can end one, several, or all of them.
Getting There
Select Admin > Sessions in the sidebar. It's in the Platform group.
Rows stream in as they load, and the toolbar shows "Loading, n so far." When the list is complete, it shows "Loaded at [time]."
What You'll See
Two cards sit at the top:
- Sessions: the total, with a bar that splits it into Active (can be used now), Inactive (idle past the inactivity time, and ends on its next request) and Ended (signed out, ended, or past its sign-in duration).
- People signed in: how many people have at least one active session. Someone on two devices counts once.
The table has one row per session:
| Column | What it shows |
|---|---|
| Person | Name and email. Your own current session carries a This device badge. |
| Role | The role the session was issued with. |
| Status | See Statuses. |
| Signed in | When the session started. |
| Last request | The last time that browser made any request, background requests included. |
| Last interaction | The last time a person used that browser. See Last Interaction. |
| Expires | When the session's sign-in duration runs out, whatever the activity. |
| Sign-in method | The identity provider used to sign in. |
| Source address | The IP address the session last connected from. |
| Client | The browser and device. Hover for the full string. |
A dash means the value wasn't recorded for that session.
Select a row to open its details.
If the session policy doesn't load, a banner says so. Signed-in sessions then show no status and can't be ended until you select Try again.
Statuses
| Status | What it means |
|---|---|
| Active | Signed in and usable. |
| Inactive | Idle past the inactivity time. It can't be used, and it ends on its next request. This shows which sessions are dead even before they make that request. |
| Expired | Past its sign-in duration. |
| Ended: inactivity | Ended because of sign out after inactivity. |
| Ended: signed out | The person signed out. |
| Ended: by [email] | An administrator ended it on this page. |
| Ended: access changed | Ended because the person's role changed. |
| Ended: account removed | Ended because the person's account, or a group that gave them access, was removed. |
Last Interaction
This column shows the last time a person used that browser. Last request also counts everything a browser does by itself.
- Not recorded: sign out after inactivity is set to Never, so interaction isn't recorded. Hover for the reason.
- None since [time]: sign out after inactivity was turned on at that time, and nobody has used the session since. This is normal for a session that started before the setting was turned on.
- A time, sometimes with a No recent interaction badge: the last recorded interaction. The badge means the browser still sends background requests but nobody has used it for a while. Hover it for how long. This is the forgotten tab that keeps polling, which looks like active use in every other column.
Searching and Filtering
- The search box matches the person's name or email, the source address and the client.
- The status filter shows All, Active, Inactive or Ended. Ended includes Expired.
Changing the search or the filter clears the rows you selected, so you never act on a row the filter hides.
Ending One Session
Use this to end one sign-in: a lost laptop, a browser someone forgot to sign out of, or any session you want closed.
- Select End session on the row, or open the row and select it there.
- Confirm.
For someone else's session, the dialog says the person will be signed out of that browser and must sign in again. For your own, it says ending it signs you out at once, and its button reads End and sign out.
The row changes to Ended: by [your email] without a reload. A "Session ended." message confirms it. If it fails, a message says the session couldn't be ended.
Ending Several Sessions at Once
Use this when you respond to an incident and don't want to end sessions one at a time.
- Select the check box on each session to end. The check box in the header selects every row shown, never a row the filter hides.
- In the bar that shows how many are selected, select End sessions. Clear selection clears them.
- Confirm.
The confirmation states how many sessions will end. Afterward a message reports the result, for example "Ended 15 sessions." or "Ended 12 of 15 sessions. 3 had already ended." Only Active and Inactive rows can be selected.
Ending Your Own Session
You can end your own session here, even your only one. Signing back in always recovers it.
When a bulk action includes your session, the bar says "Includes your current session", and the button reads End sessions and sign out. Your session always ends last, after every other one succeeds. Then you're signed out and the sign-in page opens. If any other session fails to end, yours is left alone, and the message says so.
Keeping the List Current
The page shows sessions as of the load time next to Refresh. A session you end updates at once. A row turns Inactive or Expired by itself when it passes that deadline.
A session someone else ended after the page loaded still shows its old status until you refresh. That covers another administrator, a role change, or an inactivity sign-out. If someone "can't sign in but shows as Active", check the load time, then select Refresh.
Session Expiry: What to Expect
- About five minutes before your session ends, a message says "Your session ends in about 5 minutes" and "Save your work. You'll need to sign in again." It appears once per session.
- If you were signed out for inactivity, the sign-in page says "You were signed out because you were inactive."
- If your session ended any other way, the sign-in page says "You were signed out because your session ended." That covers expiry, signing out, and a session someone else ended. The message is the same for each, so it never shows whether a session was ended or simply expired.
Troubleshooting
Signed Out Sooner Than Expected
Check Stay signed in for on your Profile & sessions page. A change there applies at your next sign-in, so sign out and in again after you change it. Your choice is also capped at your administrator's maximum, stated under the list.
If the sign-in page says "You were signed out because you were inactive.", your administrator turned on sign out after inactivity. Ask them what time is set.
Signed Out Unexpectedly
This happens when:
- Your session reached its sign-in duration.
- Sign out after inactivity is on, and you didn't interact for longer than the time set.
- You signed that device out from another device, in Active sessions.
- An administrator changed your role or removed your account, or a group that gave you access.
- An administrator ended your session on the Sessions page.
Sign in again. If your access looks different, an administrator may have changed your role.
The "Sign-out incomplete" Message
This message means GraphnAI couldn't confirm your session ended on the server, for example after a network problem. The sign-in page also says "GraphnAI couldn't confirm your sign-out."
On a shared or public device, clear your browser cookies. Signing in again doesn't clear the warning, which is only about the sign-out that just happened.
A Device Is Missing from Active Sessions
The list shows only sessions that can still be used. A session that reached its duration, went past the inactivity time, or was signed out doesn't appear.
The Session Policy Card Isn't on Admin > Users
Only Admins see it. Operators and Viewers don't.
A Chosen Sign-In Duration Is Missing from the List
If an administrator lowered the maximum below your choice, your choice is kept, with "(current)" after it. It's capped at the new maximum from your next sign-in.
People Are Signed Out Much Sooner Than the Inactivity Time
Most often their browser is still running an older version of the page, from before a platform update. That version doesn't report interaction, so the session's clock never moves. Ask them to reload the page fully. This is the likely cause if it started right after an update.
Everyone Was Signed Out When Sign Out After Inactivity Was Turned On
That shouldn't happen. Turning the setting on gives everyone signed in a full window from the moment you save.
Check the "On since" line on the Session policy card. It should match when you selected Save. If people were signed out at that same moment, report it to support.
Sessions Never End Despite an Inactivity Time
Watch a workstation nobody is using for longer than the time you set. It should show as Inactive on the Sessions page once the time passes. If it stays Active well past the time with nobody using it, report it to support.
Inactivity Sign-Outs Come a Little Earlier or Later Than the Time Set
This is expected. A browser reports interaction every 30 to 60 seconds, depending on the time you set. So a sign-out can come up to that much later, plus network delay. If the gap is minutes rather than seconds, look into it.
The Sessions Page Shows Someone as Active, but They Can't Sign In
Check the load time in the toolbar and select Refresh. The list shows sessions as they were at load time. A session that ended afterward, by someone else or by inactivity, shows as Active until you refresh.