An administrator is configuring the clock tolerance for the Single Sign-On token configuration policy and wants to define the time skew tolerance between a client and the domain controller clock. Whic

In the vCenter Single Sign-On token configuration policy, the clock tolerance field that specifies the allowable time skew between a client and a domain controller uses milliseconds as its unit of measurement. The default value is 600000 milliseconds (10 minutes), and this fine-grained unit allows precise control over the synchronization window required for SAML token acceptance.

Seconds are not the unit used in the SSO token policy clock tolerance field - the UI and API both accept and store this value in milliseconds.

Minutes are not the direct input unit for this field - although the default tolerance equates to 10 minutes, the value must be entered as milliseconds in the configuration.

Hours are not used for this setting - such a coarse unit would be inappropriate for the precision required in token time-window validation.