Manage user sessions and access with security enhancements

You can use security enhancements to better secure Dynamics 365 Customer Engagement (on-premises).

User session timeout management

By default, user sessions don't have a fixed 24-hour maximum. Users don't need to sign in with their credentials to use Customer Engagement (on-premises) and other Microsoft apps opened in the same browser session every 24 hours.

This default behavior doesn't extend an individual session beyond 24 hours. If you set a custom session timeout for an instance, the session length you configure applies. Set the session length between a minimum of 60 minutes and a maximum of 1,440 minutes (24 hours) to override the default timeout behavior.

Configure session timeout

1. In Customer Engagement (on-premises), choose Settings > Administration > System Settings > General tab.
2. Under Set session timeout, set the values to apply to all your users.

When you turn on session timeout, you configure two values:

• Session length - how long users can stay signed in before the session ends and they need to sign in again. Minimum: 60 minutes. Maximum: 1,440 minutes (24 hours).
• Timeout warning - how long before users receive a warning that the session ends, so they have time to save their work before signing in again. Minimum: 20 minutes. It must be a value shorter than the session length.

These settings apply to all users and take effect the next time a user signs in.

The timeout warning is based on the time remaining in the session, not on when the user opens the app. If a user opens or returns to the app when less time remains than the warning value, the warning appears right away. Choose a warning value that gives users enough time to save their work before the session ends. When a session expires, users must sign in again and a new session starts, so any unsaved work can be lost. To avoid lost work, it's important that users immediately save their work and sign in again when the warning appears, rather than waiting for the session to expire.

Inactivity timeout

By default, Customer Engagement (on-premises) does not enforce an inactivity session timeout. A user can remain logged in the application until the session timeout expires. You can change this behavior.

To enforce users to automatically sign out after a predetermined period of inactivity, admins can set an inactivity timeout period for Customer Engagement (on-premises). The application signs out the user when the inactivity session expires.

Microsoft Internet Explorer 11 support is deprecated. We recommend that you use Microsoft Edge. More information: Deprecation announcement

To enforce the inactivity session timeout for Web Resources, Web Resources need to include the ClientGlobalContext.js.aspx file in their solution.

The Customer Engagement (on-premises) portal has its own settings to manage its session timeout and inactivity session timeout independent of these system settings.

Configure inactivity timeout

1. In Customer Engagement (on-premises), choose Settings > Administration > System Settings > General tab.
2. Under Set inactivity timeout, set the values to apply to all your users.

Steps for enabling security enhancements for Dynamics 365 for Customer Engagement apps (on-premises) deployments

The security enhancements for Dynamics 365 for Customer Engagement apps (on-premises) are disabled by default. Administrators can enable these enhancements when using one of the following supported Dynamics 365 for Customer Engagement apps (on-premises) builds.

Requirement

These security enhancement features require the Feature Control Bit FCB.UCIInactivityTimeout to be enabled and claims-based authentication for user authentication. You can configure claims-based authentication in one of two ways:

• With an internet-facing deployment (IFD). See Configure IFD for Microsoft Dynamics 365 for Customer Engagement.
• With claims-based authentication alone, if Microsoft Dynamics 365 for Customer Engagement apps is deployed in the same domain where all Microsoft Dynamics 365 for Customer Engagement apps users are located, or users are in a trusted domain. See Configure claims-based authentication.

To obtain SDK sample code (for reference, not required to configure and enable session timeout):

1. Access your Dynamics 365 for Customer Engagement server using your administrator account.
2. Open a browser session and download the Dynamics 365 for Customer Engagement apps Software Development Kit (SDK).
3. Select and run MicrosoftDynamics365SDK.exe to extract the download and create an SDK folder on your Dynamics 365 for Customer Engagement server.
4. Open a PowerShell command prompt.
5. Navigate to the downloaded SDK folder.
6. Open the SampleCode\PS folder.

After updating to a supported on-premises version, take the following steps to enable security enhancements.

User session timeout

System admins can now force users to re-authenticate after a set period. Set an active session timeout for each of your Dynamics 365 for Customer Engagement instances. Users can only remain signed in to the application for the duration of the session. Once the session expires, they need to sign in again with their credentials. System admins can also require users to sign in after a period of inactivity. Set an inactivity timeout for each of your instances to prevent unauthorized access by a malicious user from an unattended device.

Enable user session timeout

1. Enable session timeout:

   SetAdvancedSettings.ps1 -ConfigurationEntityName ServerSettings -SettingName AllowCustomSessionDuration -SettingValue true
   

2. Enable inactivity timeout:

   SetAdvancedSettings.ps1 -ConfigurationEntityName ServerSettings -SettingName AllowCustomInactivityDuration -SettingValue true
   

Access token management

To better protect user access and data privacy in Dynamics 365 for Customer Engagement, when a user signs out in the web client and needs to return to the application, they need to enter their credentials again in all open browser sessions. Dynamics 365 for Customer Engagement apps ensures that the sign-in token was originally generated for the current browser and computer.

Enable access token management

To enable for all organizations by default, copy and run this command in PowerShell:

SetAdvancedSettings.ps1 -ConfigurationEntityName ServerSettings -SettingName WSFedNonceCookieEnabled -SettingValue true

Sample:

!SetAdvancedSettings.ps1.

-OR-

To enable for a single organization, copy and run this command in PowerShell:

SetAdvancedSettings.ps1 -ConfigurationEntityName Organization -SettingName WSFedNonceCookieEnabled -SettingValue true -Id <Your organization ID GUID>

To get [Your organization ID GUID], open PowerShell, and run the following:

Add-PSSnapin Microsoft.Crm.PowerShell 
Get-CrmOrganization

Sample:

!Example Organization ID.