ProfileSessionSetting Metadata in SFDX

Architectural Overview#

Session management is a critical pillar of enterprise cybersecurity governance. Regulatory frameworks such as HIPAA, PCI-DSS, and FedRAMP mandate strict inactivity timeouts for users handling sensitive cardholder or medical information. Conversely, setting aggressive 15-minute timeouts globally can frustrate standard sales users and reduce adoption.

The ProfileSessionSetting metadata type enables architects to tailor session lifespans per profile. Privileged administrator and financial profiles can be constrained with a 15-minute idle timeout and forced logout, while standard operational profiles enjoy extended 2-hour or 4-hour sessions.

Managing session parameters declaratively in source control guarantees that corporate governance standards are uniformly applied across all production and sandbox instances.

Directory and File Conventions#

In SFDX source projects, ProfileSessionSetting metadata files are organized in the profileSessionSettings/ directory:

Key Metadata Fields#

The XML schema of ProfileSessionSetting configures session thresholds:

Declarative XML and Package Manifest Examples#

Below is a production ProfileSessionSetting configured for a privileged administrator profile:

<?xml version="1.0" encoding="UTF-8"?>
<ProfileSessionSetting xmlns="http://soap.sforce.com/2006/04/metadata">
    <forceLogout>true</forceLogout>
    <profile>Admin</profile>
    <sessionSecurityLevel>HighAssurance</sessionSecurityLevel>
    <sessionTimeout>15</sessionTimeout>
    <sessionTimeoutWarning>true</sessionTimeoutWarning>
</ProfileSessionSetting>

Package Manifest (package.xml)#

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>Admin_Session_Setting</members>
        <name>ProfileSessionSetting</name>
    </types>
    <version>68.0</version>
</Package>

CLI Retrieval and Deployment Commands#

Manage ProfileSessionSetting metadata via the Salesforce CLI:

# Retrieve all profile session settings
sf project retrieve start --metadata ProfileSessionSetting

# Deploy specific profile session setting
sf project deploy start --metadata "ProfileSessionSetting:Admin_Session_Setting"

# Validate deployment into target sandbox
sf project deploy validate --metadata ProfileSessionSetting

Architect Best Practices and Gotchas#

• HighAssurance Configuration Verification: Ensure Identity Verification and MFA settings are configured in the target org before setting sessionSecurityLevel: HighAssurance; otherwise, users may be unable to authenticate.
• Unsaved Work and Force Logout: Setting forceLogout: true on profiles where users compose long-form notes (e.g. Case descriptions) will cause unsaved data loss on session timeout. Always enable sessionTimeoutWarning: true to give users adequate notice.
• Profile Name Resolution: The profile field must resolve to an exact Profile developer name. Custom profile renames in lower environments will break session settings deployments.

Frequently asked questions

What is the primary role of ProfileSessionSetting?

It configures session timeout durations, warning dialogs, and session security levels on a per-profile basis, overriding org defaults.

Where are ProfileSessionSetting metadata files stored in SFDX?

Files are stored in force-app/main/default/profileSessionSettings/ with the .profileSessionSetting-meta.xml suffix.

What happens when forceLogout is set to true?

When a user session exceeds the inactivity timeout duration, Salesforce terminates the session immediately, requiring the user to re-authenticate.

Can ProfileSessionSetting enforce High Assurance MFA sessions?

Yes, by configuring sessionSecurityLevel to HighAssurance, requiring multi-factor authentication before session initialization.