---
schema_version: "1"
id: 72131f6890ad62bf3e92b6d12474d92fc74d0297cb13eb95512f7e1044c034cb
title: Manage Session Policies for a Connected App
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/connected_app_manage_session_policies.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_session_policies.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: f2d1d8573fff5e173382ebe6e67e0bb4899e2471f3aed7cc1f729ee2287b68ad
description: Configure a connected app’s session policies to define how long a user’s session can last before reauthenticating. You can also use session policies to block user access to the connected app, or to require two-factor authentication to access the app.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Manage Session Policies for a Connected App

Configure a connected app’s session policies to define how long a user’s session can last before reauthenticating. You can also use session policies to block user access to the connected app, or to require two-factor authentication to access the app.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
        <colgroup>
          <col>
        </colgroup>
        <tbody>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and
              Lightning Experience</td>
          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>Connected Apps can be created in: <strong>Group</strong>, <strong>Essentials</strong>,
                <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and
                <strong>Developer</strong> Editions
              </p>
              <p style="margin-bottom:0;">Connected Apps can be installed in: All editions</p>
            </td>
          </tr>
        </tbody>
      </table> <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d14415e62">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d14415e62 ">To read, create, update, or delete connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d14415e62 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d14415e62 ">To update all fields except Profiles, Permission Sets, and Service Provider SAML
              Attributes:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d14415e62 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d14415e62 ">To update Profiles, Permission Sets, and Service Provider SAML Attributes:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d14415e62 ">Customize Application AND Modify All Data AND Manage Profiles and Permission
              Sets</td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d14415e62 ">To rotate the consumer key and consumer secret:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d14415e62 ">Allow consumer key and secret rotation</td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d14415e62 ">To install and uninstall connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d14415e62 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d14415e62 ">To install and uninstall packaged connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d14415e62 ">
              <p>Download AppExchange Packages AND Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data
                OR Manage Connected Apps</p>
            </td>
          </tr>
        </tbody>
      </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support.

See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details.

1. From Setup, enter Connected Apps in the Quick Find box, then select **Manage Connected Apps**.
2. Click **Edit** next to the connected app that you are configuring access for.
3. Under Session Policies, click the **Timeout Value** dropdown menu and select when access tokens expire for a user’s connected app session.
    
    You can control how long a user’s session lasts by setting the timeout value for the connected app, user profile, or org’s session settings (in that order). If you don’t set a value or you select **None** (the default), Salesforce uses the timeout value in the user’s profile. If the user’s profile doesn’t specify a timeout value, Salesforce uses the timeout value in the org’s Session Settings. The current permissions for the connected app are also listed in the org’s Session Settings.
4. Select **High assurance session required** to require users to verify their identity with two-factor authentication when they log in to the connected app.
    
    - Select **Block this application** to make the connected app inaccessible to your org’s users. Blocking an app ends all current user sessions with the connected app and prevents all new sessions.
    - Select **Raise the session level to high assurance** to require users to verify their identity with two-factor authentication when they log in to the connected app. Only authorization flows that include a user approval step support using API logins with the High Assurance session security level. These flows are the OAuth 2.0 refresh token flow, web server flow, and user-agent flow. All other flows, such as the JSON Web Token (JWT) bearer token flow, don’t include a user approval step. For flows without a user approval step, API logins with the High Assurance session security level are blocked.