<p>Can it be done or the only way is to configure it on IIS?</p>

You edit generally the Global.asax file's Session_Start method and set
Session.TimeOut
to whatever you want.  You can do this anywhere else in your code too.