Control: 1.1.15 Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users
Description
Forcing a time out for MFA will help ensure that sessions are not kept alive for an indefinite period of time, ensuring that browser sessions are not persistent will help in prevention of drive-by attacks in web browsers, this also prevents creation and saving of session cookies leaving nothing for an attacker to take.
Administrative roles this should apply to include those such as:
- Global Administrator
- Billing Administrator
- Exchange Administrator
- SharePoint Administrator
- Password Administrator
- Skype for Business Administrator
- Service Support Administrator
- User Administrator
- Dynamics 365 Service Administrator
- Power BI Administrator
Note: The frequency at which MFA is prompted will be determined by your organization's policy and need.
Ensuring these additional controls are present for Administrative users adds an additional layer of defense against drive-by attacks and even some ransomware attacks.
Remediation
To enable the multifactor timeout and persistent browser settings are set for administrators, use the Microsoft 365 Admin Center:
- Log in to
https://admin.microsoft.com
as aGlobal Administrator
. - Go to
Admin centers
and click onAzure Active Directory
. - Select
Enterprise applications
then, underSecurity
, selectConditional Access
. - Click
New policy
. - Go to
Assignments
>Users and groups
>Include
>Select users and groups
> checkDirectory roles
. - At a minimum, select the following roles:
Billing admin
,Conditional Access admin
,Exchange admin
,Global admin
,Helpdesk admin
,Security admin
,SharePoint admin
, andUser admin
.
- Targeting any role with the word
admin
will ensure that any users with additional privileges will be targeted.
- Go to
Cloud apps or actions
>Cloud apps
>Include
> selectAll cloud apps (and don't exclude any apps)
. - Under
Access controls
>Grant
> selectGrant access
> checkRequire multi- factor authentication
(and nothing else). - Under
Session
checkSign-in frequency
and enter the value determined by your organization. - Check
Persistent browser session
then selectNever persistent
in the drop-down menu. - Create.
NOTE: After creation ensure that the policy is set to enabled.
Usage
Run the control in your terminal:
powerpipe control run microsoft365_compliance.control.cis_v150_1_1_15
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run microsoft365_compliance.control.cis_v150_1_1_15 --share
SQL
This control uses a named query:
azuread_signin_frequency_policy