Organization session settings
Key Takeaway
Org session settings on the Session Settings page in Setup apply to users unless their profile's session settings override them. The session timeout counts inactivity. It is two hours by default, and Salesforce recommends 15 minutes or less.
When a user logs in, they start a session with Salesforce. The session stays usable until it ends or times out. Org session settings control how long sessions last, how they end, and where they can be used. They limit the risk that someone gets into your org through a computer left unattended while a user is still logged in, or through a stolen session token. They also limit internal attacks, such as one employee trying to use another employee's session.
Org session settings and profile session settings
Admins configure org-wide session behavior on the "Session Settings" page in Setup. Options include timeout restrictions, the session connection type, and IP address ranges.
If a profile's session settings are configured...
The profile session settings override the org session settings for users of that profile.
If a profile's session settings aren't configured...
The org session settings apply to users of that profile.
For example, imagine an org that keeps the default two-hour timeout on its Session Settings page, while the System Administrator profile has its own shorter timeout. A user with the System Administrator profile times out after the profile's shorter period of inactivity. A user whose profile has no session settings configured times out after two hours of inactivity, because the org session settings apply to them.
High-privilege profiles such as System Administrator can have stricter, shorter timeouts than the org session settings. If you use only the timeout in the org session settings instead, the damage is greater if someone hijacks an admin's session.