From cf503f51aa45ed31a2621de0d5e1a93371591c00 Mon Sep 17 00:00:00 2001
From: Brian Smith <brian@smith.berlin>
Date: Mon, 21 Sep 2026 10:59:28 +0200
Subject: [PATCH] feat(docs): Add SignOut policy

---
 .../docs/reference/policies/SignOut.mdx       | 29 +++++++++++++++++++
 src/plugins/inject-oma-uri.mjs                |  1 +
 2 files changed, 30 insertions(+)
 create mode 100644 src/content/docs/reference/policies/SignOut.mdx

diff --git a/src/content/docs/reference/policies/SignOut.mdx b/src/content/docs/reference/policies/SignOut.mdx
new file mode 100644
index 0000000..030c33c
--- /dev/null
+++ b/src/content/docs/reference/policies/SignOut.mdx
@@ -0,0 +1,29 @@
+---
+title: "SignOut"
+description: "Configure sign-out behavior for enterprise users."
+category: "Authentication"
+---
+
+Configure sign-out behavior for enterprise users.
+
+By default, shutting the browser down signs the session out, so the next launch requires the user to sign in again.
+Set this policy to lock the session on shutdown instead, so that returning users only need to unlock it.
+
+## Examples
+
+<PolicyExample policy="SignOut" />
+
+## Values
+
+- `Shutdown`: Controls what happens to the session when the browser shuts down.
+  - `Action`: (**required**) A string, one of:
+    - `lock`: Lock the session, so the next launch only requires the user to unlock.
+    - `signout`: Sign the session out, so the next launch requires a full sign-in.
+      This is what happens when the policy is not set.
+
+## Compatibility
+
+<PolicyCompat policy="SignOut" />
+
+**CCK2 Equivalent:** N/A\
+**Preferences Affected:** N/A
diff --git a/src/plugins/inject-oma-uri.mjs b/src/plugins/inject-oma-uri.mjs
index b233e5e..84d7ee8 100644
--- a/src/plugins/inject-oma-uri.mjs
+++ b/src/plugins/inject-oma-uri.mjs
@@ -17,6 +17,7 @@ const NO_ADMX_EQUIVALENT = new Set([
   "EnterprisePoliciesEnabled", // Registry bootstrap, outside the ADMX namespace.
   "MicrosoftEntraSSO", // macOS only.
   "SecurityLogging", // Configured through the admin console, not local policy.
+  "SignOut", // Configured through the admin console, not local policy.
   "Watermark", // Configured through the admin console, not local policy.
 ]);