Control: 5.9 Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0'
Description
Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0.
This setting is necessary if 'Require users to register when signing in' is enabled. If authentication re-confirmation is disabled, registered users will never be prompted to reconfirm their existing authentication information. If the authentication information for a user changes, such as a phone number or email, then the password reset information for that user reverts to the previously registered authentication information.
Remediation
Remediate from Azure Portal
- From Azure Home select the Portal Menu.
- Select
Microsoft Entra ID. - Under
Manage, selectUsers. - Select
Password reset. - Under
Manage, selectRegistration. - Set the
Number of days before users are asked to re-confirm their authentication informationto your organization-defined frequency. - Click
Save.
Default Value
By default, the Number of days before users are asked to re-confirm their authentication information is set to "180 days".
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v500_5_9Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v500_5_9 --shareSQL
This control uses a named query:
select id as resource, 'info' as status, 'Manual verification required.' as reason, display_name as subscriptionfrom azure_subscription;