Understanding disconnect causes

This page explains disconnect reasons in greater detail. Use it together with a client troubleshooting guide to identify which of the reasons below is responsible for a disconnection.

Devolutions Cloud

Refresh token lifetime

Devolutions Cloud refresh tokens have a lifetime of 24 hours for the web client and 30 days for all other clients, including the browser extension. If a user does not interact with the client during that period, they must reconnect. This lifetime cannot be changed.

Force prompt login

This setting forces a user to reconnect when a client reconnects to its data source from scratch. This can happen, for example, after the client is closed and re-opened. Cases vary from client to client.

Setting location: Administration – Access & authentication – Force prompt login.

Single sign-on (SSO)

If SSO is enforced (meaning users can sign in to Devolutions Cloud only through their SSO provider), the identity provider controls the user's session. If the identity provider, such as Microsoft Entra ID or Okta, signs the user out, Devolutions Cloud also disconnects the user. It can take an hour or more for this disconnection to reach Devolutions Cloud.

Setting location: Administration – Access & authentication – Authentication modes.

Inactivity timeout

Users are disconnected when they do not interact with their device for the configured period. Interaction includes actions such as moving the mouse cursor or typing.

Setting location: Administration – Access & authentication – Inactivity logout time.

Authentication session deleted

An authentication session can be deleted in several ways, including:

• An administrator deletes the session in the portal's Sign-in & security section.
• The user resets or forgets their password.
• The user signs out from the client.

When a session is deleted, the web client disconnects within approximately five minutes if the user has not already signed out. Other clients are not affected.

The browser shares one session across Devolutions web clients. If you disconnect from Devolutions Cloud in the browser, you will most likely also be disconnected from Devolutions Portal, and vice versa.

User disabled or expired

If a user's account is disabled or expired, the next time the client contacts Devolutions Cloud it receives a disabled-user error. Some clients disconnect the user when they receive this error.

Setting location: Administration – Users – select the user – Enabled.

Devolutions Server

Refresh token expired

Devolutions Server lets administrators configure the refresh token lifetime, which defaults to 30 days. If a user does not interact with a client during that period, they must reconnect.

Setting location: Administration – Server settings – Advanced – Refresh token lifetime.

IP address invalid

When public IP validation is enabled, the user's IP address must remain the same for the entire session. If the IP address changes after the user signs in, the user is disconnected.

Setting location: Administration – Server settings – Security – Force token public IP validation.

Force disconnect

An administrator can revoke a user's session, which disconnects the user. The disconnection can take up to five minutes.

Setting location: Administration – Reports – Connected user list – select the user – Disconnect.

Single sign-on (SSO) disconnect

Users signed in with an SSO account can be disconnected by their identity provider, such as Microsoft Entra ID or Okta. It can take an hour or more for the disconnection to reach the client.

Setting location: Administration – Server settings – Authentication.

Server inactivity timeout

Users are disconnected when they do not interact with their device for the configured period. Interaction includes actions such as moving the mouse cursor or typing.

Setting location: Administration – System settings – RDM and Password Manager clients – select the client – On idle.

Disconnect on close

Users are signed out when the client they are using is closed.

Setting location: Administration – System settings – RDM and Password Manager clients – select the client > On close.