My company has an external auth provider for the whole organization, and MFA is required (push notification to a phone app). This all works well and I agree with it, BUT they have configured the credentials to expire in 20 minutes. In practice this means everyone in the company is typing their password and fiddling with their phone dozens of times per day to work with any application except for email (somehow it gets away with caching the credentials).
Timeouts for credentials are good, but does this aggressively low setting actually provide increased security?
Nothing like training users to punch creds into every box that appears! It is absolutely bad. There’s no need to ask for credentials; the refresh token will be invalidated if passwords change etc.
Plus, it’s expensive. 24 times a day, 30 seconds. 12 min per user per day of wasted productivity.
Sounds like someone just read up on token theft and panicked.
Bad thing is, such panicky footgunnery tends to make it into long term policy.