CIS.M365.5.2.2.4 - (L1) Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users
Overview
An enabled Conditional Access policy sets a short sign-in frequency and turns off persistent browser sessions for the administrative roles.
A session token that stays valid for days or survives a browser restart can be stolen and replayed on another machine. Administrators hold the most valuable sessions, so shortening how long a session lasts, and not keeping it after the browser closes, limits how long a stolen token is useful.
The policy must apply to the same set of administrative roles as the MFA test, cover all cloud apps, set a sign-in frequency of 4 hours or less (or every time), set persistent browser session to Never persistent and be enabled.
User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Conditional Access > Policies and select New policy.
- Under Users, select Directory roles and add the administrative roles. Exclude your emergency access accounts.
- Under Target resources, select All resources (formerly All cloud apps).
- Under Session, select Sign-in frequency and set it to Periodic reauthentication of 4 hours or less, or Every time.
- Under Session, select Persistent browser session and choose Never persistent.
- Set Enable policy to On (use Report-only first to measure the impact) and select Create.
Related links
- Microsoft Entra admin center - Conditional Access policies
- Configure adaptive session lifetime policies
- Conditional Access: Session controls
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.4
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.2.4 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Privileged access |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1550.004 Web Session Cookie |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.4 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.2.4, nist-800-53-r5:AC-12 |
| PowerShell test | Test-MtCisAdminSignInFrequency |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.2.4.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.2.4.md