---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Limit policy based session access mobile refresh token interval

# Limit policy based session access mobile refresh token interval {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the glide.authenticate.session_access.mobile.refresh_token_interval property to govern the length of time that must elapse before a mobile device user will be forced to re-authenticate.
The glide.authenticate.session_access.mobile.refresh_token_interval suystem property governs the length of time after which a mobile device user will be forced to re-authenticate. This only applies if the
admin has configured the Identity Provider attributes (which can vary for each login) in the session access policy and the user authenticates via Single Sign On (SSO). The property value is an integer in seconds. The
recommended value is <kbd class="ph userinput">1800</kbd> (30 minutes).

Ensure that the glide.authenticate.session_access.mobile.refresh_token_interval property is set to a value of <kbd class="ph userinput">1800</kbd> or below.

## More information {#sc-limit-policy-based-session-access-mobile-refresh__section_more_information}

{#sc-limit-policy-based-session-access-mobile-refresh__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.authenticate.session_access.mobile.refresh_token_interval |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | integer |
| Recommended value | An integer less than or equal to 1800 |
| Default value | \<none\> |
| Fallback value | 1800 |
| Category | [Session management](https://www.servicenow.com/docs/jJnJ0Q0eYjnQREHSQvPPjA "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 4.3 * CVSS score: Medium * Security risk details: A large value may grant a larger timeframe for session access to be hijacked by an attacker. {#sc-limit-policy-based-session-access-mobile-refresh__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | Zero Trust- Policy Based Session Access |
| Functional impact | This setting governs the time in seconds after login, that users will be forced to logout from mobile devices if they are using Single Sign On to authenticate, and admin has configured the Identify provider attributes in the session access policy. |
[ ]

{#sc-limit-policy-based-session-access-mobile-refresh__table_ajc_b43_3kb}