diff --git a/server/src/lib/paloalto.js b/server/src/lib/paloalto.js
index 2b59536..72b03e6 100644
--- a/server/src/lib/paloalto.js
+++ b/server/src/lib/paloalto.js
@@ -3,26 +3,32 @@
 import axios from 'axios'
 import prisma from '../prisma'
 import https from 'https'
+import { subMinutes } from 'date-fns'
 import qs from 'qs'
 
+const DEBOUNCE_TIME_IN_MS = 5000
+const TIMEOUT_IN_MINUTES = '3'
+
 const httpsAgent = new https.Agent({
   rejectUnauthorized: false
 })
 
 let working = false
 
-const DEBOUNCE_TIME_IN_MS = 5000
-
 async function updateUserIdMappings() {
   if (working) return -1
 
   working = true
 
+  const now = new Date()
+  const timeoutThreshold = subMinutes(now, TIMEOUT_IN_MINUTES)
+
   try {
     const wifiDevices = await prisma.wifiDevice.findMany({
       where: {
         userId: { not: null },
         status: 'ONLINE',
+        lastSeen: { gt: timeoutThreshold },
         ip: { startsWith: process.env.PA_NET }
       },
       select: {
@@ -31,12 +37,10 @@ async function updateUserIdMappings() {
       }
     })
 
-    const timeout = '3'
-
     const entries = wifiDevices.reduce(
       (entries, device) =>
         entries +
-        `<entry name="ifms\\${device.user.sAMAccountName}" ip="${device.ip}" timeout="${timeout}"/>\n`,
+        `<entry name="ifms\\${device.user.sAMAccountName}" ip="${device.ip}" timeout="${TIMEOUT_IN_MINUTES}"/>\n`,
       ''
     )