Control: 1.1.3 Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users
Description
In complex deployments, organizations might have a need to restrict authentication sessions. Conditional Access policies allow for the targeting of specific user accounts. Some scenarios might include:
- Resource access from an unmanaged or shared device
- Access to sensitive information from an external network
- High-privileged users
- Business-critical applications
Ensure Sign-in frequency does not exceed 4 hours for E3 tenants, or 24 hours
for E5 tenants using Privileged Identity Management.
Ensure Persistent browser session
is set to Never persist
.
NOTE: This CA policy can be added to the previous CA policy in this benchmark "Ensure multifactor authentication is enabled for all users in administrative roles"
Forcing a time out for MFA will help ensure that sessions are not kept alive for an indefinite period of time, ensuring that browser sessions are not persistent will help in prevention of drive-by attacks in web browsers, this also prevents creation and saving of session cookies leaving nothing for an attacker to take.
Remediation
To configure Sign-in frequency and browser sessions persistence for Administrative users:
- Navigate to
Microsoft Entra admin center
https://entra.microsoft.com/. - Click to expand
Azure Active Directory
>Applications
SelectEnterprise applications
. - Under
Security
, selectConditional Access
. - Click
New policy
. - Click
Users and groups
. - Under
Include
selectSelect users and groups
and then selectDirectory roles
. - At a minimum, select the roles in the section below:
- Go to
Cloud apps or actions
>Cloud apps
>Include
> selectAll cloud apps (and don't exclude any apps)
. - Under
Access controls
>Grant
> selectGrant access
> checkRequire multi- factor authentication
(and nothing else). - Under
Session
selectSign-in frequency
and set to at most4 hours
for E3 tenants. E5 tenants with PIM can be set to a maximum value of24 hours
. - Check
Persistent browser session
then selectNever persistent
in the drop- down menu. - For
Enable Policy
selectOn
and clickSave
.
At minimum these directory roles should be included for MFA:
- Application administrator
- Authentication administrator
- Billing administrator
- Cloud application administrator
- Conditional Access administrator
- Exchange administrator
- Global administrator
- Global reader
- Helpdesk administrator
- Password administrator
- Privileged authentication administrator
- Privileged role administrator
- Security administrator
- SharePoint administrator
- User administrator
Default Value: The Azure Active Directory (Azure AD) default configuration for user sign-in frequency is a rolling window of 90 days.
Usage
Run the control in your terminal:
powerpipe control run microsoft365_compliance.control.cis_v200_1_1_3
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run microsoft365_compliance.control.cis_v200_1_1_3 --share
SQL
This control uses a named query:
azuread_signin_frequency_policy