You need to set the idle time out on the CRM application pool. The removed frames in v7.2 mean the idle time out at the app pool come into play. See here:

technet.microsoft.com/.../cc771956(v=ws.10).aspx

Found it. So is it consistent with all 7.2 versions (then why have it a changeable setting) or is there some reason it's being overridden?

The design of 7.2 is quite different to previous version, in previous versions there was a frame that called the server, thus meaning the idle time out was never reached. In 7.2, it doesn't exist any more, so the idle time out comes into play.

https://community.sagecrm.com/partner_community/b/hints_tips_and_tricks/archive/2013/08/06/sage-crm-7-2-changing-iis-settings-to-prevent-unwanted-quot-logouts-quot.aspx

And here is a bit more info on it:

https://community.sagecrm.com/partner_community/b/hints_tips_and_tricks/archive/2013/04/01/sage-crm-v7-2-the-impact-of-frameset-removal-on-code-in-upgraded-systems.aspx

The two settings are quite different. On a live site with many users, what are the chances that no users will make any contact to the app pool for 20 minutes? The user time out is on a user by user basis, not global.