Session security and high-assurance sessions
Key Takeaway
Each session is Standard or High Assurance, based on how the user logged in. If the Reports and Dashboards policy requires High Assurance, Lightning Experience users with a Standard session are blocked from reports and dashboards and don't see their icons in the navigation menu.
When a user logs in, Salesforce starts a session. Session security controls how long that session lasts and how much Salesforce trusts it. Each login method gives the session one of two security levels: Standard or High Assurance. Admins can then reserve sensitive resources for High Assurance sessions, such as setup areas, reports and dashboards, logins for specific profiles, and connected apps.
What session security protects
A session begins when a user logs in. Session security limits exposure when a user leaves a logged-in computer unattended. Session security also limits internal attacks, such as one employee trying to use another employee's session.
Closing a browser window or tab doesn't log a user out of their Salesforce session. Users should end their session with "Your Name | Logout".