access reviewer cannot complete certification: session timeout error in Okta how to fix

TL;DR

Lengthen the working session for the reviewer population or change how the work is chunked, because re-logging in is not a fix when every login still expires mid-batch. Check the Okta session and sign-on policy values that apply to reviewers, compare them with how long a real certification batch takes, and raise the session or idle window for the reviewer group during the campaign window. Confirm decisions save incrementally so a timeout never discards a whole batch of completed work.

access reviewer cannot complete certification: session timeout error in Okta how to fix

Use this when

• Reviewers report being signed out while working through certification items.
• Decisions entered in a long session are missing after re-login.
• Timeouts cluster on reviewers with the largest item counts.

Not for this skill when

• Reviewers cannot see the campaign at all. That is an assignment problem, not a session problem.
• A reviewer account is locked or suspended. Restore the account through the normal route.

Steps

1. Collect two or three concrete reports with the reviewer name, the approximate minutes they worked before the timeout and whether entered decisions survived. Verify: reports include timings and a clear answer on lost work.
2. Open the Okta sign-on and session policies that apply to the reviewer group and record the session lifetime and idle timeout values in force. Verify: the governing policy values are recorded for the reviewer population.
3. Compare those values with a realistic batch time by timing one reviewer working through twenty typical items without rushing. Verify: a measured batch time exists to set the window against.
4. Raise the idle or session window for the reviewer group for the campaign period through the policy, keeping stronger authentication at initial sign-in so security posture stays intact. Verify: the updated policy shows the new window scoped to the reviewer group.
5. Have an affected reviewer sign in fresh, work a full typical batch past the old timeout point, and confirm the session holds and decisions save as they go. Verify: the reviewer completes the batch in one session with all decisions present.
6. If long sessions are not acceptable to security, split large assignments into smaller batches in the campaign and tell reviewers the batch size, so each batch fits the existing window. Verify: reviewers receive batches sized under the measured safe time.
7. Note the campaign period policy change, its expiry and the batch guidance in the review evidence, and set the policy to revert after the campaign closes. Verify: the evidence records the temporary change and its revert date.

Why it happens

Reviewer sessions inherit general sign-on policy values tuned for ordinary app use, where an idle timeout of a few minutes is harmless. Certification work is different: a reviewer reads evidence, checks another system, and thinks, all while the session clock runs. The mismatch means the most careful reviewers, and those with the biggest queues, are the ones timed out. Fixing it is a policy scoping job, not a user behaviour job, and any temporary widening should be group scoped and time boxed to the campaign.

Variants and edge cases

reviewer signed out during Okta certification

The user report phrasing. Ask for the minutes worked; that number decides whether policy or batch size is the right lever.

Okta session expires too quickly for access review

The policy phrasing. Check both total lifetime and idle timeout; either one can end the session.

certification decisions lost after re-login

The data loss phrasing. If decisions do not save incrementally, raise that with the campaign owner as a separate defect from the timeout itself.

Edge cases to check before closing the review cycle:

• Global policy changes affect every app, not only the review. Scope changes to the reviewer group wherever the policy model allows.
• Shared workstations in some teams shorten safe session windows. Batch splitting fits those teams better than long sessions.
• A timeout during a decision submission can double-submit on retry. Teach reviewers to check the item state after re-login before deciding again.

Compatibility: Okta sign-on and session policies, Okta Identity Governance certification campaigns, reviewer groups scoped in Okta policies.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstsL0zbDhqUNw9Cw6A7eYvw