CIS.M365.5.2.2.13 - (L1) Ensure that periodic reauthentication is required for all users
Overview
An enabled Conditional Access policy requires all users to sign in again after at most seven days.
Without a limit, a session can stay valid for a very long time, and a refresh token that is stolen keeps working until the user next changes password. Periodic reauthentication forces a new sign-in, and a new MFA challenge, at a predictable interval, which caps how long a stolen session is useful.
The policy must apply to all users and all cloud apps, set the frequency to 7 days or less (or every time) and be enabled. Short intervals add prompts for users, so pick the longest interval that your risk appetite allows.
User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Conditional Access > Policies and select New policy.
- Under Users, include All users. Exclude your emergency access accounts.
- Under Target resources, select All resources (formerly All cloud apps).
- Under Session, select Sign-in frequency, choose Periodic reauthentication and enter 7 days or less (or choose Every time).
- Set Enable policy to On (use Report-only first to measure the impact) and select Create.
Related links
- Microsoft Entra admin center - Conditional Access policies
- Configure adaptive session lifetime policies
- Conditional Access: Session controls
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.13
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.2.13 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1550.004 Web Session Cookie |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.13 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.2.13, nist-800-53-r5:AC-12 |
| PowerShell test | Test-MtCisPeriodicReauthentication |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.2.13.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.2.13.md