OIDC Session Calculator

renewals per session = ceil(session length ÷ ID token lifetime) − 1; polling load = concurrent sessions ÷ poll interval. OIDC session load has two very different components. Authorisation and silent renewal traffic scales with session length divided by token lifetime, but session-status polling scales with concurrency divided by the poll interval — and at a few seconds per poll it dwarfs everything else.

Most OIDC capacity surprises are polling, not logins: fifty thousand sessions polling every five seconds is ten thousand requests per second before a single user actually signs in.

This calculator takes 7 inputs: Concurrent signed-in users, Single sign-on session length, ID token lifetime, check_session_iframe poll interval, Session state stored per user, Identity provider nodes, Relying parties per session. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Back-channel logout where you can. Session polling was designed before third-party cookie restrictions and now both leaks capacity and breaks in modern browsers. Back-channel logout pushes one signed request per relying party at sign-out, which is bounded work rather than continuous load.

Long enough to avoid re-prompting through a working day — eight hours is a common default, with Entra ID defaulting to a rolling window — and short enough that an unattended device does not stay signed in indefinitely. Pair a long session with short ID and access tokens so revocation still lands quickly.