OWA 2013 and Timeout

Question

OWA 2013 (CU6) timeout values have been set according the following article.
http://www.msexchange.org/kbase/ExchangeServerTips/ExchangeServer2013/OutlookOWA/how-configure-public-and-private-computer-settings-owa-2013.html
On the "external" or "public" side - default is 15 minutes.  When 15 minutes of inactivity occurs, OWA does not exit the session.  Instead the content remains on the screen - and you can browse around the information that remains
in the display.  You cannot create a new message or open a message in a new window.
If a browser "refresh" is sent the logon to OWA screen appears.
Contacted Microsoft and they were also able to reproduce this same behavior.
This is not a secure way to handle timeout.  Anyone else experience this?

Answer 1

Hi,
The time-out feature will only works with Forms-Based Authentication method enabled on CAS server.
http://technet.microsoft.com/en-us/library/bb124787(v=exchg.141).aspx
Although this document applies to Exchange 2010, it’s just the same in Exchange 2013.
In addition, is there TMG in your deployment? If yes, please refer to the following document to
configure the idle session time-out period for Outlook Web Access clients.
Before performing this task, we must have a Web listener that uses forms-based authentication for Outlook Web Access.
http://technet.microsoft.com/en-us/library/cc995140.aspx
Best Regards.