# Setup Session Invalidator feature

To further strengthen session management and reinforce secure user access, ZTrust now offers enhanced controls under the Session Invalidation Notification feature. This capability ensures that only the active session remains valid, thereby preventing unauthorized or unmonitored concurrent access.

**Introduction**

Session management is a critical component of identity and access control. ZTrust introduces refined session invalidation capabilities that enable administrators to define how multiple login sessions are handled, providing an added layer of control and security. These options help organizations enforce stricter login behaviors, mitigating the risk of unauthorized access through abandoned or shared sessions.

**Previous Functionality**

Previously, the Session Invalidation Notification section supported only the "Allow Maximum Login Sessions" option. This allowed administrators to configure the maximum number of concurrent sessions a user could maintain. Upon reaching the session limit, the system would automatically terminate the oldest active session to accommodate a new login.

**New Feature: "Deny New Session"**

With ZTrust V4.0.0, we have introduced a second option: "Deny New Session". When this setting is enabled and the configured maximum session limit is reached, any new login attempt is denied. The system does not invalidate older sessions, thereby enforcing the session limit strictly until an existing session is manually terminated or expires.

**Benefits**

* Stronger session control and visibility
* Prevents unauthorized concurrent logins
* **Fully configurable** based on organizational policies
* Supports **compliance**, **risk management**, and **auditability**

These new enhancements enable ZTrust administrators to tailor session behaviors to better suit compliance, risk, and operational requirements.

Follow the below steps to set up Session Invalidator feature

1.  Login to ZTrust Admin Console.



    <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FIZhwlJzBFEav64AeUQLu%2Fimage.png?alt=media&#x26;token=e2dedb16-eed9-47c3-b048-8abba59d1f35" alt=""><figcaption></figcaption></figure>
2.  Click on Authentication.

    <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FU1d3NoKTm2zClK1tmT8E%2Fimage.png?alt=media&#x26;token=bbd243d0-273a-4582-8d7d-d3b0815bb62f" alt=""><figcaption></figcaption></figure>
3. Click on Duplicate and create a copy of Browser Flow.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FMvgfVdThbPOH1UN8VIme%2F38.png?alt=media&#x26;token=b03375f4-d211-4bbb-b639-1e4e81fb2c64" alt=""><figcaption></figcaption></figure>

4. Provide any name. For example - Session Invalidation and click on OK.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FotQl2jHnfPP42UxUPBlM%2F39.png?alt=media&#x26;token=c999ee57-8cd3-46be-acc5-eed8a037b063" alt=""><figcaption></figcaption></figure>

5. Click on Duplicate.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FMALl2uiixP1oeQlMnipz%2F40.png?alt=media&#x26;token=c2e7901e-a15a-41cb-994a-2e0aadec2d72" alt=""><figcaption></figcaption></figure>

6. Delete all except the Session Invalidation Forms.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FxynYjNPqraACLE9T8iUy%2F42.png?alt=media&#x26;token=c3b18c6f-9401-4706-be97-d54ff6c4716a" alt=""><figcaption></figcaption></figure>

7. Click on Add step.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FURVyEExTOJ97ck61Edge%2F43.png?alt=media&#x26;token=5835b9ed-f614-41d8-92ff-31a48bd24c9b" alt=""><figcaption></figcaption></figure>

8. Select Advanced Session Invalidator.
9. Click on Add.
10. For Advanced Session Invalidator, make the requirement as Required.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FqrysAnDv51OaDIYtnXRS%2F44.png?alt=media&#x26;token=910ccea1-c724-4e12-a67d-80216153f854" alt=""><figcaption></figcaption></figure>

11. For Advanced Session Invalidator, click on settings.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FCZ1tmB2urv68Y20DdTW6%2F45.png?alt=media&#x26;token=8973c292-6d2e-4a58-8639-b89ff7cc0391" alt=""><figcaption></figcaption></figure>

12. Now two options now provide administrators with greater control over session management:
    * **Allow Maximum Login Sessions:** Allows new logins by terminating the oldest session once the session limit is reached.
    * **Deny New Session:** Prevents any new logins once the session limit is reached, unless an existing session is manually terminated or expires.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FpjPWHtvwRpJb8GungYFl%2Fimage.png?alt=media&#x26;token=831bfaf5-9247-4bc3-a947-b53e845208b7" alt="" width="437"><figcaption></figcaption></figure>

13. Click on Save.
14. Click on Action, and then Bind flow.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FVDEU8bKWehoRATOnXVKU%2F47.png?alt=media&#x26;token=c6f7d536-a170-4ace-9fb4-5b9decd3301f" alt=""><figcaption></figcaption></figure>

15. Select Browser flow from the dropdown menu.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FmvXqClBNWXr5RG5OtIsT%2F48.png?alt=media&#x26;token=24bad253-0912-4ee7-b499-b8d85d06ab84" alt=""><figcaption></figcaption></figure>

16. Click on Save.

Session Invalidation feature is configured now.

\
