Document dashboard session security controls

dashboard/session-security.mdx

@@ -0,0 +1,69 @@
+---
+title: "Session security"
+description: "Configure dashboard session timeouts, maximum session lifetime, and an IP allowlist to enforce stricter authentication and network access policies."
+keywords: ["session", "timeout", "authentication", "security", "SSO", "IP allowlist"]
+---
+
+<Info>
+  Session security settings are available on [Enterprise plans](https://mintlify.com/pricing?ref=session-security).
+</Info>
+
+Enterprise admins can require dashboard users to reauthenticate on a schedule that fits your organization's security policies. Two independent controls determine when a dashboard session ends:
+
+- **Idle session timeout**: How long a session can remain inactive before the user is signed out.
+- **Maximum session lifetime**: The absolute lifetime of a session, regardless of activity. When exceeded, the user is signed out and must reauthenticate.
+
+Each setting has its own enable toggle. If a setting is disabled, Mintlify's default applies. Both settings accept values between **5 minutes and 14 days** (20,160 minutes).
+
+## Configure session lifetimes
+
+To review or change session lifetimes, go to the **Policies** tab of the [Identity & access](https://app.mintlify.com/settings/organization/access?tab=policies) page in your dashboard.
+
+For each setting, use the toggle to enable or disable it, enter a value, choose a unit (minutes, hours, days, or weeks for maximum lifetime; minutes, hours, or days for idle timeout), and select **Save**. Disabling a setting and saving clears it so Mintlify's default takes over.
+
+### Idle session timeout
+
+The idle session timeout controls how long a session can remain inactive before it expires. Any dashboard request from the user resets the idle timer.
+
+Use a shorter idle timeout to reduce the risk of unattended sessions being used by someone other than the signed-in user, for example on shared or unlocked devices.
+
+### Maximum session lifetime
+
+The maximum session lifetime is the absolute cap on how long a single sign-in can last. It is measured from the moment the user signed in and is not extended by activity. When the maximum lifetime is reached, the user is signed out even if they are actively using the dashboard.
+
+Use a maximum lifetime to guarantee that users reauthenticate on a regular cadence, which can help you meet compliance requirements or revalidate access after identity provider changes.
+
+## How the settings interact
+
+The two settings apply independently. A user's session ends at whichever limit is reached first:
+
+- If the user is inactive for longer than the **idle session timeout**, the session ends.
+- If the **maximum session lifetime** elapses since sign-in, the session ends even if the user is active.
+
+For example, if you set the idle timeout to 1 hour and the maximum lifetime to 8 hours, an actively working user is signed out after 8 hours, and an idle user is signed out after 1 hour.
+
+## Restrict dashboard access by IP
+
+Use the IP allowlist to restrict dashboard access to a set of trusted networks. When the allowlist has one or more entries, only requests from those IPs or ranges can sign in to or use the dashboard. When the allowlist is empty, the dashboard is accessible from any IP address.
+
+<Warning>
+  If your current IP address is not on the allowlist, you can lock yourself out of the dashboard. Confirm your IP is included before saving.
+</Warning>
+
+To configure the allowlist, go to the **Policies** tab of the [Identity & access](https://app.mintlify.com/settings/organization/access?tab=policies) page in your dashboard.
+
+- **Add an entry**: Enter an IPv4 or IPv6 address, or a CIDR range (for example, `203.0.113.7` or `10.0.0.0/8`), then select **Add**. Adding the first entry enables the allowlist.
+- **Remove an entry**: Select the **×** on any entry. Removing the last entry disables the allowlist.
+- **Check your IP**: Your current IP address is shown below the entry list so you can confirm it is covered before saving changes.
+
+The status badge next to **IP allowlist** shows **Active** when at least one entry is present and **Disabled** when the list is empty.
+
+## Audit logging
+
+Changes to session security settings are recorded in your organization's [audit logs](/dashboard/audit-logs) under the `org` category. Look for these actions to review who updated the settings and when:
+
+- `org.session_security_session_duration_updated`
+- `org.session_security_session_duration_deleted`
+- `org.session_security_max_session_lifetime_updated`
+- `org.session_security_max_session_lifetime_deleted`
+- `org.session_security_ip_allowlist_updated`

docs.json

@@ -205,6 +205,7 @@
                     "group": "Dashboard access",
                     "pages": [
                       "dashboard/sso",
+                      "dashboard/session-security",
                       "dashboard/network-access",
                       "dashboard/scim",
                       "dashboard/permissions",