Why might an enterprise administrator shorten SAML-authorized session lifetime for members accessing GitHub Enterprise Cloud with SSO?

When organizations use SAML SSO, GitHub sessions can remain authorized for a policy-controlled duration after successful IdP authentication. Shortening that lifetime reduces the window during which a lost laptop or unattended browser remains useful to an attacker, at the cost of more frequent SSO prompts. The administrative goal is residual session risk reduction balanced against user friction. Session lifetime does not globally revoke every fine-grained PAT, does not change Git LFS quotas, and does not rewrite classic PATs into fine-grained tokens. Admins should align session policy with IdP session settings, CAP, and break-glass procedures for incident response when accounts may be compromised.