Google Cloud expands session controls with 16-hour default

Google Cloud has expanded its session controls for customers and completed the rollout of a 16-hour default session length. The update also moves session policy management into Context-Aware Access.

The changes are intended to give administrators more precise control over how long users stay signed in and where stricter reauthentication rules apply.

The revised setup adds programmatic support for session policy management through Terraform, the gcloud command-line tool, and REST APIs. Administrators can now define and apply session settings through infrastructure and automation workflows rather than relying only on manual configuration in a user interface.

This change is now generally available. It places session controls within a broader access management approach for cloud environments, where policy changes are often handled through code and central automation.

Granular policies

A key part of the update is a shift in how policies are targeted. Session lengths were previously tied to organisational units, but administrators can now apply them through Google Groups.

That allows different categories of users to receive different session rules regardless of where they sit in a company hierarchy. Google gave the example of applying a two-hour session to users with elevated privileges, such as billing administrators and project owners, while keeping a standard 16-hour session for general developers.

Google has also introduced application-specific controls. Instead of applying one policy across every application that requires Google Cloud API scopes, administrators can now set session controls for the Google Cloud Console, the gcloud tool, and specific OAuth applications.

This narrower approach is designed to let security teams tighten controls in one area without automatically affecting unrelated software connections. That could reduce the risk of business intelligence or dashboarding integrations being disrupted by a stricter setting applied elsewhere.

Default standard

Alongside the broader policy changes, Google Cloud has completed the extension of a 16-hour default session length to customers that had not already configured their own settings. The company described that as a security standard aimed at reducing the risk of credential theft and account takeover.

Session management has become more prominent for cloud providers and their customers as administrators seek to balance user access with stricter identity checks. Reauthentication requirements can limit the window in which stolen credentials remain useful, but they can also create operational friction if applied too broadly.

By tying controls to groups and specific applications, Google is trying to address that tension with more targeted policy options. The integration with Context-Aware Access also brings session settings closer to other controls that govern access based on conditions and risk.

Cloud console preview

Customers can also sign up to manage session policies through the Google Cloud Console rather than only through the Google Workspace administrator console. That option is available in preview and would place session policy administration alongside other access levels and security bindings in Access Context Manager.

The move reflects a shift in where cloud administrators expect to manage security settings. For organisations that rely primarily on Google Cloud tools rather than the wider Workspace administration environment, keeping policy controls in the same console may simplify operational tasks.

The changes come as cloud security teams place greater emphasis on identity-based controls, particularly in response to account takeover risks and the spread of multi-tenant environments. Support for REST APIs and command-line administration is also likely to matter for larger organisations that need to enforce consistent settings across complex estates.

Administrators can now define and manage session policies programmatically while applying separate rules to different user groups and applications.