CIS.M365.1.3.2 - (L2) Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devices
Overview
Browser sessions on unmanaged devices for Microsoft 365 apps end after at most three hours of inactivity.
A browser that someone leaves open on a shared or personal computer keeps the Microsoft 365 session signed in. Anyone who walks up to it, or any malware that runs on it, can use the session. A short idle timeout signs the user out of the web apps when nothing happens for a while.
Two parts are needed: an activity-based timeout policy with a web session idle timeout of 3 hours or less, and a Conditional Access policy that uses Use app enforced restrictions for browser access to Office 365 so that the timeout applies to unmanaged devices. The test looks at both.
User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.
Remediation action
- Sign in to the Microsoft 365 admin center.
- Go to Settings > Org settings > Security & privacy > Idle session timeout and turn it on with a timeout of 3 hours or less.
- Sign in to the Microsoft Entra admin center and go to Entra ID > Conditional Access > Policies.
- Create a policy for All users and the Office 365 app, with Client apps set to Browser only. Under Session, select Use app enforced restrictions and enable the policy.
Related links
- Microsoft 365 admin center - Idle session timeout
- Idle session timeout for Microsoft 365
- Conditional Access: session controls
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 1.3.2
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.1.3.2 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft 365 |
| Related products | Entra ID |
| Feature | Organization settings |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1550.004 Web Session Cookie |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 1.3.2 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:1.3.2, nist-800-53-r5:AC-12 |
| PowerShell test | Test-MtCisIdleSessionTimeout |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cis/Test.CIS.M365.1.3.2.ps1 - Documentation:
tests/cis/Test.CIS.M365.1.3.2.md