Microsoft Intune service must initiate a session lock after a 15-minute period of inactivity
DISA.V-267303MediumMicrosoft 365Organization settingsPreview 3.0Runs with -IncludePreview
Part of DISA · Microsoft 365 · Organization settings · All checks
Invoke-Maester -TestId DISA.V-267303 -IncludePreviewOverview
Section titled “Overview”The Microsoft 365 idle session timeout signs users out after 15 minutes of inactivity or less. (DISA Microsoft Intune MDM Service Desktop STIG, V-267303, CAT II).
A session left open on an unattended computer can be used by anyone who sits down at it. The Intune admin center follows the idle session timeout of Microsoft 365.
The newer Intune MDM STIG has the same rule, so this test runs DISA.V-273867: the idle session timeout must be 15 minutes or less.
Remediation action
Section titled “Remediation action”- In the Microsoft 365 admin center, go to Settings > Org settings > Security & privacy > Idle session timeout.
- Turn on Turn on to set the period of inactivity for users to be signed off of Microsoft 365 web apps.
- Choose Custom, set the period to 15 minutes and select Save.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | DISA.V-267303 |
| Severity | Medium |
| Suite | DISA |
| Product | Microsoft 365 |
| Related products | Entra ID |
| Feature | Organization settings |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1550.004 Web Session Cookie |
| Supports benchmark | DISA Microsoft Intune MDM Service Desktop STIG (version V1R1), requirement V-267303 |
| Supports controls | disa-stig-intune-desktop:V-267303, nist-800-53-r5:AC-11, nist-800-53-r5:AC-12 |
| PowerShell test | Test-MtDisaIntuneDesktopIdleSessionTimeout |
| Services | Graph |
| Lifecycle | Preview |
Source
Section titled “Source”- Test:
tests/disa/Test.DISA.V-267303.ps1 - Documentation:
tests/disa/Test.DISA.V-267303.md