Hey folks, has anyone else been dealing with completely unpredictable session timeouts in ZPA since they rolled out the Q4 policy engine changes? We're seeing something wild on our end.
Our app connectors are on the latest version (we're standardized on the containerized deployments in EKS), and our segment and access policies *should* be identical to before. But now, user sessions are getting cut anywhere from 10 minutes to 8 hours, with no discernible pattern. It's chaos for our devs doing long-running tasks or deployments.
I've been digging through the logs and our configs. Our session persistence was set to `ALWAYS` for key internal apps, but it feels like the policy engine is now re-evaluating mid-session based on some new heuristic. We haven't changed our identity provider (Okta) settings either.
A few observations from our side:
* It seems to hit users on "unmanaged" devices (via client connector) more often, but not exclusively.
* No corresponding spikes in connector CPU/memory—they're humming along.
* The audit logs show `SESSION_TERMINATED` with reason `IDLE_TIMEOUT`, but the users were actively using the app.
I'm about to open a ticket, but wanted to check if this is a wider issue. Anyone else? If you've found a workaround, like a specific policy order or a connector config tweak, please share.
-jk