diff --git a/public/components/settings.html b/public/components/settings.html
index f88883d..b4cd898 100644
--- a/public/components/settings.html
+++ b/public/components/settings.html
@@ -133,8 +133,8 @@
             </div>
           </div>
 
-          <!-- Active Sessions -->
-          <div class="settings-section card">
+          <!-- Active Sessions — hidden for SSO-only users (revoke can't stick against an active IdP session) -->
+          <div class="settings-section card" id="sessions-section" style="display:none;">
             <h3><i class="fas fa-desktop"></i> Active Sessions</h3>
             <p style="font-size:13px;color:var(--g600);">Devices where you are currently logged in. Revoke any session to immediately log that device out.</p>
             <div style="margin-bottom:10px;">
diff --git a/public/js/auth.js b/public/js/auth.js
index 57655cb..54a2460 100644
--- a/public/js/auth.js
+++ b/public/js/auth.js
@@ -743,16 +743,20 @@ document.addEventListener('DOMContentLoaded', function() {
       }
       // Keep cache in sync
       window.CURRENT_USER = data.user;
-      // Sections are display:none by default in the HTML. Only reveal them
-      // if the server confirms this user has a real password hash
-      // (canLocalAuth === true). SSO-auto-created users never see these UIs.
+      // Sections are display:none by default in the HTML. Reveal them only
+      // for users with a real password hash (canLocalAuth === true).
+      // SSO-only users never see password change, 2FA, or session
+      // management — session revoke can't stick against an active IdP
+      // session, so showing it would be misleading.
       var pwSection = document.getElementById('change-password-section');
       var twofaSection = document.getElementById('2fa-section');
+      var sessionsSection = document.getElementById('sessions-section');
       if (data.user.canLocalAuth !== true) {
-        return; // Stay hidden — nothing more to load for SSO-only users
+        return;
       }
       if (pwSection) pwSection.style.display = '';
       if (twofaSection) twofaSection.style.display = '';
+      if (sessionsSection) sessionsSection.style.display = '';
       var status = document.getElementById('2fa-status');
       var setupBtn = document.getElementById('btn-setup-2fa');
       var disableBtn = document.getElementById('btn-disable-2fa');