SAML authentication token timeout/revocation for remote access VPN

[Sam2]

Does anyone know if the full endpoint client will periodically check if the saml token used for VPN auth is still valid? Does it check when the tunnel is renegotiated when it reaches its timeout?

In testing I had my saml token revoked, all my ms office products immediately forced a re-auth but the VPN client has remained connected, curious if there is an official answer to how revoking a saml token will impact the vpn. 

[PhoneBoy · Accepted solution]

If it's consistent with how it works for other authentication methods, it's done at the re-authentication timer.