(L1) Ensure that periodic reauthentication is required for all users
Part of CIS · Entra ID · Conditional Access · All checks
Invoke-Maester -TestId CIS.M365.5.2.2.13Overview
Section titled “Overview”An enabled Conditional Access policy requires all users to sign in again after at most seven days.
Without a limit, a session can stay valid for a very long time, and a refresh token that is stolen keeps working until the user next changes password. Periodic reauthentication forces a new sign-in, and a new MFA challenge, at a predictable interval, which caps how long a stolen session is useful.
The policy must apply to all users and all cloud apps, set the frequency to 7 days or less (or every time) and be enabled. Short intervals add prompts for users, so pick the longest interval that your risk appetite allows.
User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.
Remediation action
Section titled “Remediation action”- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Conditional Access > Policies and select New policy.
- Under Users, include All users. Exclude your emergency access accounts.
- Under Target resources, select All resources (formerly All cloud apps).
- Under Session, select Sign-in frequency, choose Periodic reauthentication and enter 7 days or less (or choose Every time).
- Set Enable policy to On (use Report-only first to measure the impact) and select Create.
Related links
Section titled “Related links”- Microsoft Entra admin center - Conditional Access policies
- Configure adaptive session lifetime policies
- Conditional Access: Session controls
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.13
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.2.13 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1550.004 Web Session Cookie |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.13 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.2.13, nist-800-53-r5:AC-12 |
| PowerShell test | Test-MtCisPeriodicReauthentication |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
Section titled “Source”- Test:
tests/cis/Test.CIS.M365.5.2.2.13.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.2.13.md