Control: 5.1.3 Ensure that 'Allow users to remember multifactor authentication on devices they trust' is disabled
Description
[IMPORTANT - Please read the section overview: If your organization pays for Microsoft Entra ID licensing (included in Microsoft 365 E3, E5, F5, or Business Premium, and EM&S E3 or E5 licenses) and CAN use Conditional Access, ignore the recommendations in this section and proceed to the Conditional Access section.]
Do not allow users to remember multi-factor authentication on devices.
Remediation
Remediate from Azure Portal
- From Azure Home select the Portal Menu.
- Select
Microsoft Entra ID. - Under
Manage, clickUsers. - Click the
Per-user MFAbutton on the top bar. - Click on
Service settings. - Uncheck the box next to
Allow users to remember multi-factor authentication on devices they trust. - Click
Save.
Default Value
By default, Allow users to remember multi-factor authentication on devices they trust is disabled.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v500_5_1_3Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v500_5_1_3 --shareSQL
This control uses a named query:
select id as resource, 'info' as status, 'Manual verification required.' as reason, display_name as subscriptionfrom azure_subscription;