From ec8a525d94fd7d695d728216910f43641678816d Mon Sep 17 00:00:00 2001 From: Lutao Xie Date: Fri, 11 Sep 2026 13:10:15 -0400 Subject: [PATCH 1/4] Document Strict UI Session Mode Co-authored-by: Cursor --- docs/best-practices/security-controls.mdx | 56 +++++++++++++++++++++++ docs/cloud/manage-access/index.mdx | 12 +++-- 2 files changed, 64 insertions(+), 4 deletions(-) diff --git a/docs/best-practices/security-controls.mdx b/docs/best-practices/security-controls.mdx index 5b287a518c..df7c1d8314 100644 --- a/docs/best-practices/security-controls.mdx +++ b/docs/best-practices/security-controls.mdx @@ -43,6 +43,62 @@ When applicable, use [SCIM](/cloud/manage-access/scim) or the Temporal Cloud use For non-human access (CI/CD pipelines, backend services), use [Temporal Cloud Service Accounts](/cloud/manage-access/service-accounts) instead of shared user logins. Service Accounts are machine identities that can be granted specific permissions without ties to an individual. Create separate Service Accounts with unique API keys for different applications or microservices, and apply least privilege to each (for example, a service account that only has access to one Namespace). +### Restrict Cloud UI session lifetimes + +Strict UI Session Mode is an optional account-level setting for organizations that require shorter sessions for users +authenticated through [SAML single sign-on (SSO)](/cloud/manage-access/saml). + +When enabled, Strict UI Session Mode: + +- Signs users out after 15 minutes of inactivity, instead of 12 hours. +- Limits the maximum session duration to 12 hours, instead of 7 days, even if the user remains active. + +When either limit is reached, the user must start a new Cloud UI session through the account's SAML identity provider. +Whether the identity provider prompts the user to enter credentials or complete MFA depends on the identity provider's +own session policy. + +These predictable session limits can help organizations enforce internal security policies and complete security and +compliance reviews. Enabling Strict UI Session Mode does not by itself guarantee compliance with a particular standard +or regulation. + +#### Prerequisites + +Before enabling Strict UI Session Mode, [SAML SSO](/cloud/manage-access/saml) must be configured and active for the +account. + +Strict UI Session Mode applies only to Cloud UI sessions authenticated through SAML. It does not affect other +authenticated interactions with Temporal, including: + +- Users who sign in through Google, Microsoft, or email and password +- Workers or SDK clients +- API Keys or Service Accounts +- Temporal CLI sessions +- mTLS connections + +#### Enable Strict UI Session Mode + +[Create a support ticket](/cloud/support#support-ticket) and provide your +[Temporal Cloud Account Id](/cloud/namespaces#temporal-cloud-account-id). Ask Dev Success to enable Strict UI Session +Mode for the account. + +Strict UI Session Mode applies to the entire account. It cannot be configured for individual users, groups, or roles. +The 15-minute inactivity limit and 12-hour maximum session duration are fixed. + +The setting applies when a user starts a new session. Users with an active session must sign out and start a new session +before the shorter limits take effect. + +#### Understand how inactivity is measured + +Only Cloud UI activity that sends a request to Temporal Cloud resets the inactivity timer. Mouse movement, scrolling, or +reading information that has already loaded does not reset the timer. + +The Cloud UI does not display a warning or countdown before the session expires. + +The 12-hour maximum applies regardless of activity. + +To disable Strict UI Session Mode, [create a support ticket](/cloud/support#support-ticket). Active sessions retain the +shorter limits until users sign out and start new sessions. + ## Secure application authentication and API access Clients interact with the Temporal Service to initiate and manage Workflows, while Workers execute the business logic defined in Workflows and Activities in your own environment. diff --git a/docs/cloud/manage-access/index.mdx b/docs/cloud/manage-access/index.mdx index 209f96159b..d7f79579bf 100644 --- a/docs/cloud/manage-access/index.mdx +++ b/docs/cloud/manage-access/index.mdx @@ -17,10 +17,14 @@ Access to Temporal Cloud is governed by role-based access control (RBAC). Within as user, user group or service account, has one account-level role and optionally, one or more Namespace-level permissions. Each principal can only perform actions that are allowed by their assigned roles and permissions. -Temporal Cloud supports Security Assertion Markup Language (SAML) and System for Cross-domain Identity Management (SCIM) -for integration with your organization's identity provider (IdP). SAML enables single sign-on (SSO) by allowing your -identity provider to authenticate users into Temporal Cloud. SCIM automatically creates, updates, and removes users and -groups in Temporal Cloud based on changes in your identity provider. +Temporal Cloud supports [Security Assertion Markup Language (SAML)](/cloud/manage-access/saml) and +[System for Cross-domain Identity Management (SCIM)](/cloud/manage-access/scim) for integration with your organization's +identity provider (IdP). SAML enables single sign-on (SSO) by allowing your identity provider to authenticate users into +Temporal Cloud. SCIM automatically creates, updates, and removes users and groups in Temporal Cloud based on changes in +your identity provider. + +To enforce shorter sessions for SAML-authenticated Cloud UI users, see +[Restrict Cloud UI session lifetimes](/best-practices/security-controls#restrict-cloud-ui-session-lifetimes). ## Temporal Cloud accounts From f8e3411e61d0883dbdfab612b0638a7a088d5c1d Mon Sep 17 00:00:00 2001 From: Lutao X Date: Fri, 11 Sep 2026 14:23:42 -0400 Subject: [PATCH 2/4] Apply suggestion from @LutaoX --- docs/best-practices/security-controls.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/best-practices/security-controls.mdx b/docs/best-practices/security-controls.mdx index df7c1d8314..e359728d8a 100644 --- a/docs/best-practices/security-controls.mdx +++ b/docs/best-practices/security-controls.mdx @@ -75,7 +75,7 @@ authenticated interactions with Temporal, including: - Temporal CLI sessions - mTLS connections -#### Enable Strict UI Session Mode +#### Enable strict UI session mode [Create a support ticket](/cloud/support#support-ticket) and provide your [Temporal Cloud Account Id](/cloud/namespaces#temporal-cloud-account-id). Ask Dev Success to enable Strict UI Session From 44c004d6d9c4804481c005b1ecceb545f7831d7b Mon Sep 17 00:00:00 2001 From: Lutao X Date: Fri, 11 Sep 2026 15:31:14 -0400 Subject: [PATCH 3/4] Apply suggestion from @LutaoX --- docs/best-practices/security-controls.mdx | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/docs/best-practices/security-controls.mdx b/docs/best-practices/security-controls.mdx index e359728d8a..d1ba686530 100644 --- a/docs/best-practices/security-controls.mdx +++ b/docs/best-practices/security-controls.mdx @@ -89,12 +89,9 @@ before the shorter limits take effect. #### Understand how inactivity is measured -Only Cloud UI activity that sends a request to Temporal Cloud resets the inactivity timer. Mouse movement, scrolling, or -reading information that has already loaded does not reset the timer. +Only Cloud UI activity that sends a request to Temporal Cloud resets the inactivity timer (e.g. create a Namespace). Mouse movement, scrolling, or reading information that has already loaded does not reset the timer. -The Cloud UI does not display a warning or countdown before the session expires. - -The 12-hour maximum applies regardless of activity. +The Cloud UI does not display a warning or countdown before the session expires. The 12-hour maximum applies regardless of activity. To disable Strict UI Session Mode, [create a support ticket](/cloud/support#support-ticket). Active sessions retain the shorter limits until users sign out and start new sessions. From a598e423b86ca16cc85c89b9cd578769fda50850 Mon Sep 17 00:00:00 2001 From: Lutao X Date: Tue, 15 Sep 2026 09:59:46 -0400 Subject: [PATCH 4/4] Update docs/best-practices/security-controls.mdx Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- docs/best-practices/security-controls.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/best-practices/security-controls.mdx b/docs/best-practices/security-controls.mdx index d1ba686530..25be121756 100644 --- a/docs/best-practices/security-controls.mdx +++ b/docs/best-practices/security-controls.mdx @@ -89,7 +89,7 @@ before the shorter limits take effect. #### Understand how inactivity is measured -Only Cloud UI activity that sends a request to Temporal Cloud resets the inactivity timer (e.g. create a Namespace). Mouse movement, scrolling, or reading information that has already loaded does not reset the timer. +Only Cloud UI activity that sends a request to Temporal Cloud resets the inactivity timer (for example create a Namespace). Mouse movement, scrolling, or reading information that has already loaded does not reset the timer. The Cloud UI does not display a warning or countdown before the session expires. The 12-hour maximum applies regardless of activity.