zpa-create-timeout-policy-rule

What this skill does

# ZPA: Create Timeout Policy Rule

## Keywords

timeout policy, session timeout, idle timeout, reauth timeout, re-authentication, session expiry, idle disconnect, timeout rule, session duration, zpa timeout, reauth policy

## Overview

Create ZPA timeout policy rules that define session re-authentication and idle timeout behavior. Timeout policies control how long a user's authenticated session remains valid and how long an idle connection persists before requiring re-authentication. Different applications and user groups can have different timeout values.

**Use this skill when:** An administrator asks to configure session timeouts, set idle disconnect timers, require re-authentication after a specific period, or apply different timeout rules to different applications or user groups.

---

## Timeout Parameters

### `reauth_timeout` (Session Timeout)

How long a user session remains valid before requiring re-authentication, regardless of activity.

| Value Format | Examples | Description |
|---|---|---|
| `<number> Minutes` | `"30 Minutes"`, `"60 Minutes"` | Session expires after N minutes |
| `<number> Hours` | `"4 Hours"`, `"8 Hours"` | Session expires after N hours |
| `<number> Days` | `"1 Days"`, `"10 Days"`, `"30 Days"` | Session expires after N days |
| `Never` | `"Never"` | Session never expires (not recommended for sensitive apps) |

Minimum: 10 minutes. Default: `"172800"` (seconds, i.e., 2 days).

### `reauth_idle_timeout` (Idle Timeout)

How long an idle (inactive) connection persists before the session is terminated.

| Value Format | Examples | Description |
|---|---|---|
| `<number> Minutes` | `"10 Minutes"`, `"30 Minutes"` | Idle session expires after N minutes |
| `<number> Hours` | `"1 Hours"`, `"2 Hours"` | Idle session expires after N hours |
| `<number> Days` | `"1 Days"` | Idle session expires after N days |
| `Never` | `"Never"` | Idle sessions never expire |

Minimum: 10 minutes. Default: `"600"` (seconds, i.e., 10 minutes).

### Action

The only supported action is `RE_AUTH` -- when the timeout is reached, the user must re-authenticate.

---

## Baseline Values (recommended)

Reference: ZPA Baseline Recommendations v1.0 §Timeout Policies Recommendations.

### Authentication timeout (`reauth_timeout`)

| Profile | Value | Rationale |
|---|---|---|
| **Default — high-security environment** | `"24 Hours"` | Daily MFA / SSO revalidation. |
| **Default — convenience-focused** | `"3 Days"` to `"7 Days"` | Lower friction for low-risk tenants. |
| **Service accounts (documented exception)** | `"30 Days"` or `"Never"` | Only with explicit security exception and inventory tracking. |

Apply a single global authentication-timeout rule and add narrow per-group exceptions only when justified.

### Idle timeout (`reauth_idle_timeout`) — per app class

| App class | Value | Why |
|---|---|---|
| Non-sensitive apps | `"15 Minutes"` to `"30 Minutes"` | Frees connector resources, low security risk. |
| Sensitive apps (Finance, HR, regulated) | `"10 Minutes"` to `"15 Minutes"` | Tighter idle window for crown-jewel apps. |
| Long-lived sessions (RDP, SSH, DB) | `"30 Minutes"` to `"60 Minutes"` | Avoids dropping interactive shells mid-session. |
| Background services / API agents / monitoring | `"Never"` | Disable idle so automated clients don't reconnect on every poll. |

**Anti-pattern:** Avoid `reauth_idle_timeout` below `"10 Minutes"` — causes constant tunnel reconnects and poor user experience.

---

## Condition Object Types

Timeout policies support a subset of condition types.

### Value-Based (use `values`)

| Object Type | Description | Values |
|---|---|---|
| `APP` | Application segments | Application segment IDs |
| `APP_GROUP` | Segment groups | Segment group IDs |
| `CLIENT_TYPE` | Client connector type | `zpn_client_type_zapp`, `zpn_client_type_exporter`, `zpn_client_type_browser_isolation`, `zpn_client_type_ip_anchoring`, `zpn_client_type_edge_connector`, `zpn_client_type_branch_connector`, `zpn_client_type_zapp_partner` |

### Entry-Values Based (use `entry_values` with `lhs`/`rhs`)

| Object Type | LHS | RHS |
|---|---|---|
| `SAML` | SAML attribute ID | Attribute value to match |
| `SCIM` | SCIM attribute header ID | Attribute value to match |
| `SCIM_GROUP` | Identity Provider ID | SCIM group ID |
| `PLATFORM` | `linux`, `android`, `ios`, `mac`, `windows` | `"true"` or `"false"` |
| `POSTURE` | Posture profile `posture_udid` | `"true"` or `"false"` |

---

## Workflow

### Step 1: Gather Requirements

Ask the administrator:

**Required:**

- Rule name
- Session timeout value (e.g., "8 Hours", "30 Days", "Never")
- Idle timeout value (e.g., "30 Minutes", "1 Hours", "Never")

**Optional:**

- Description
- Which applications or segment groups to scope to
- Which users/groups this applies to
- Platform restrictions
- Posture requirements

**Common scenarios:**

- "Sessions should expire after 8 hours for all apps" -> global timeout rule
- "Sensitive apps should have a 30-minute idle timeout" -> scoped to APP_GROUP
- "Contractors should re-authenticate every 4 hours" -> scoped to SCIM_GROUP
- "Mobile devices should have shorter timeouts" -> scoped to PLATFORM

---

### Step 2: Look Up Required IDs

**For application scoping:**

```text
zpa_list_segment_groups()
zpa_list_application_segments()
```text

**For identity conditions:**

```text
get_zpa_scim_group(search="<group_name>")
get_zpa_saml_attribute(search="<attribute_name>")
```text

**For posture profiles:**

```text
get_zpa_posture_profile(search="<profile_name>")
```text

---

### Step 3: Create the Rule

```text
zpa_create_timeout_policy_rule(
  name="<rule_name>",
  action_type="RE_AUTH",
  reauth_timeout="<session_timeout>",
  reauth_idle_timeout="<idle_timeout>",
  description="<description>",
  conditions=<conditions_payload>
)
```text

---

### Step 4: Verify

```text
zpa_get_timeout_policy_rule(rule_id="<returned_rule_id>")
```text

---

## Ready-to-Use Examples

### Example 1: Standard Timeout for a Segment Group

Set 8-hour session timeout and 30-minute idle timeout for internal applications.

**Step 1: Find the segment group**

```text
zpa_list_segment_groups()
```text

**Step 2: Create rule**

```text
zpa_create_timeout_policy_rule(
  name="Standard Timeout - Internal Apps",
  action_type="RE_AUTH",
  reauth_timeout="8 Hours",
  reauth_idle_timeout="30 Minutes",
  description="Standard session and idle timeouts for internal applications",
  conditions=[
    {
      "operator": "OR",
      "operands": [
        {
          "object_type": "APP_GROUP",
          "values": ["<internal_apps_segment_group_id>"]
        }
      ]
    }
  ]
)
```text

---

### Example 2: Strict Timeout for Sensitive Applications

Short session timeout (4 hours) and aggressive idle timeout (10 minutes) for sensitive apps.

```text
zpa_create_timeout_policy_rule(
  name="Strict Timeout - Sensitive Apps",
  action_type="RE_AUTH",
  reauth_timeout="4 Hours",
  reauth_idle_timeout="10 Minutes",
  description="Short timeouts for sensitive/high-security applications",
  conditions=[
    {
      "operator": "OR",
      "operands": [
        {
          "object_type": "APP_GROUP",
          "values": ["<sensitive_apps_segment_group_id>"]
        }
      ]
    }
  ]
)
```text

---

### Example 3: Contractor-Specific Timeout

Contractors must re-authenticate every 4 hours with a 15-minute idle timeout.

**Step 1: Look up contractor group**

```text
get_zpa_scim_group(search="Contractors")
```text

**Step 2: Create rule**

```text
zpa_create_timeout_policy_rule(
  name="Contractor Timeout",
  action_type="RE_AUTH",
  reauth_timeout="4 Hours",
  reauth_idle_timeout="15 Minutes",
  description="Shorter session for contractor accounts",
  conditions=[
    {
      "operator": "OR",
      "operands": [
        {
          "object_type": "SCIM_GROUP",
          "entry_values": [
            {"lhs": "<idp_id>", "rhs": "<contractors_scim_group_id>"}
          ]
        }
      ]
    }
  ]
)
```text

--