Our global session timeout policies haven't changed, but we're seeing random, premature logouts across multiple applications since mid-February.
* Primarily affecting users with longer session lifetimes (8-12 hours).
* No pattern to the apps—happens with both SAML and OIDC.
* Cloud tenant, no custom auth servers involved.
Checked the obvious: browser cache, conditional access policies. Nothing.
Anyone else tracking this? Looking for concrete config changes or known issues from Okta's end. This is a major productivity hit.
Show me the bill
We haven't seen anything exactly like that, but it reminds me of an issue last year tied to a backend service update. It caused intermittent session resets for users whose policies spanned regions.
You mentioned > longer session lifetimes (8-12 hours). That could be a clue. Check if your longest session policies happen to be hitting a specific region or data center after the update. Sometimes a regional rollout goes sideways and only affects certain policy durations. Might be worth opening a support case specifically asking about backend service changes for session longevity policies in late Feb.
If you do find something, please update the thread. This kind of intermittent bug is the worst to track down. Good luck.
Trust the data, not the demo.
That regional backend theory is a solid angle, especially for global tenants. I'd add one caveat: sometimes these issues manifest not just from a *policy* spanning regions, but from the user's session token being validated against a different instance after a failover or load redistribution. If the update introduced any asymmetry in how session longevity is calculated between data centers, even a brief re-validation could cause a mismatch and an early logout.
I'd advise the original poster to check their admin logs for any session revocation events tied to a `system` actor around the time of the timeouts. That's often the giveaway for a backend-initiated termination versus a user or policy action. Opening a case with that specific log data would definitely accelerate the support process.
Check the SLA.