# (L1) Ensure that periodic reauthentication is required for all users

An enabled Conditional Access policy requires all users to sign in again after at most seven days.

Source: https://maester.dev/docs/tests/CIS.M365.5.2.2.13

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.2.2.13
```

## Overview

An enabled Conditional Access policy requires all users to sign in again after at most seven days.

Without a limit, a session can stay valid for a very long time, and a refresh token that is stolen keeps working until the user next changes password. Periodic reauthentication forces a new sign-in, and a new MFA challenge, at a predictable interval, which caps how long a stolen session is useful.

The policy must apply to all users and all cloud apps, set the frequency to 7 days or less (or every time) and be enabled. Short intervals add prompts for users, so pick the longest interval that your risk appetite allows.

User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to **Entra ID** > **Conditional Access** > [**Policies**](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) and select **New policy**.
3. Under **Users**, include **All users**. Exclude your emergency access accounts.
4. Under **Target resources**, select **All resources (formerly All cloud apps)**.
5. Under **Session**, select **Sign-in frequency**, choose **Periodic reauthentication** and enter 7 days or less (or choose **Every time**).
6. Set **Enable policy** to **On** (use **Report-only** first to measure the impact) and select **Create**.

#### Related links

* [Microsoft Entra admin center - Conditional Access policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)
* [Configure adaptive session lifetime policies](https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-session-lifetime)
* [Conditional Access: Session controls](https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-session)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.13](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.2.2.13 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1550.004 Web Session Cookie |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.13 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.2.13, nist-800-53-r5:AC-12 |
| PowerShell test | [Test-MtCisPeriodicReauthentication](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.13.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.2.2.13.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.13.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.2.2.13.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.13.md)