# Microsoft Intune service must initiate a session lock after a 15-minute period of inactivity

The Microsoft 365 idle session timeout signs users out after 15 minutes of inactivity or less.

Source: https://maester.dev/docs/tests/DISA.V-267303

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/merill" title="Merill Fernando · Original author"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/merill">Merill Fernando</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/disa">DISA</a> · Microsoft 365 · Organization settings · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId DISA.V-267303 -IncludePreview
```

## Overview

The Microsoft 365 idle session timeout signs users out after 15 minutes of inactivity or less. (DISA Microsoft Intune MDM Service Desktop STIG, V-267303, CAT II).

A session left open on an unattended computer can be used by anyone who sits down at it. The Intune admin center follows the idle session timeout of Microsoft 365.

The newer Intune MDM STIG has the same rule, so this test runs [DISA.V-273867](https://maester.dev/docs/tests/DISA.V-273867): the idle session timeout must be 15 minutes or less.

#### Remediation action

1. In the [Microsoft 365 admin center](https://admin.microsoft.com), go to **Settings** > **Org settings** > **Security & privacy** > **[Idle session timeout](https://admin.microsoft.com/#/Settings/SecurityPrivacy/:/Settings/L1/IdleSessionTimeout)**.
2. Turn on **Turn on to set the period of inactivity for users to be signed off of Microsoft 365 web apps**.
3. Choose **Custom**, set the period to **15 minutes** and select **Save**.

#### Related links

* [DISA Microsoft Intune MDM Service Desktop STIG: V-267303](https://cyber.trackr.live/stig/Intune_Service_Desktop/1/1/V-267303)
* [Idle session timeout for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/manage/idle-session-timeout-web-apps)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | DISA.V-267303 |
| Severity | Medium |
| Suite | DISA |
| Product | Microsoft 365 |
| Related products | Entra ID |
| Feature | Organization settings |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1550.004 Web Session Cookie |
| Supports benchmark | DISA Microsoft Intune MDM Service Desktop STIG (version V1R1), requirement V-267303 |
| Supports controls | disa-stig-intune-desktop:V-267303, nist-800-53-r5:AC-11, nist-800-53-r5:AC-12 |
| PowerShell test | [Test-MtDisaIntuneDesktopIdleSessionTimeout](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-267303.ps1) |
| Services | Graph |
| Lifecycle | Preview |

</details>

## Source

- Test: [`tests/disa/Test.DISA.V-267303.ps1`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-267303.ps1)
- Documentation: [`tests/disa/Test.DISA.V-267303.md`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-267303.md)