Confluence session persistence after external directory account disablement

Goal: Bound the window in which a disabled or expired external directory account can still access Confluence, so directory least-privilege state is enforced sooner than the default session lifetime.

In self-managed Confluence Server or Data Center connected to LDAP or Active Directory, Confluence maintains its own session state after login and does not revalidate directory credentials on every request. Existing sessions and Remember Me cookies can remain valid after account disablement or password expiry until session timeout, cookie expiry, or cluster cache eviction. Confluence global and space permissions are stored independently and are not automatically removed when the directory account changes. Revocation timing varies by version, directory connector, and cache configuration.

Which Confluence setting or supported extension forces revalidation of external directory account status at a defined interval? Can session invalidation be triggered immediately when directory credentials expire or an account is disabled? What is the maximum access window imposed by session timeout and Remember Me settings in this scenario?