I think it's designed with functioning desktop SSO in mind. A longer session timeout would probably make it less painful for those without that but security teams tend to frown at that. Regardless functional desktop SSO is something they should stop expecting their customers to have in place if they ever want to thoroughly capture the SMB market.