My company has an external auth provider for the whole organization, and MFA is required (push notification to a phone app). This all works well and I agree with it, BUT they have configured the credentials to expire in 20 minutes. In practice this means everyone in the company is typing their password and fiddling with their phone dozens of times per day to work with any application except for email (somehow it gets away with caching the credentials).
Timeouts for credentials are good, but does this aggressively low setting actually provide increased security?
Not really, as too much friction causes people to bypass it in other ways. Ask about things like yubikeys perhaps?
Thanks, I’ll ask about that.