Microsoft Entra ID must initiate a session lock after a 15-minute period of inactivity
Part of DISA · Microsoft 365 · Organization settings · All checks
Invoke-Maester -TestId DISA.V-270200 -IncludePreviewOverview
Section titled “Overview”Idle sessions are signed out after 15 minutes of inactivity or less. (DISA Microsoft Entra ID STIG, V-270200, CAT II).
A session left open on an unattended computer can be used by anyone who sits down at it. DISA asks Microsoft Entra ID to lock a session after 15 minutes without activity.
The STIG’s check reads the directory-level idle timeout of the Azure portal (Settings > Signing out + notifications), which has no documented API. Microsoft 365 applies its idle session timeout to the Azure portal as well, unless the portal sets its own value, so this test runs DISA.V-273867, which reads that timeout, with a maximum of 15 minutes. Check the portal setting by hand if it is configured there.
Remediation action
Section titled “Remediation action”- In the Microsoft 365 admin center, go to Settings > Org settings > Security & privacy > Idle session timeout.
- Turn on Turn on to set the period of inactivity for users to be signed off of Microsoft 365 web apps.
- Choose Custom, set the period to 15 minutes and select Save.
- In the Azure portal, select the gear icon > Signing out + notifications, select Enable directory level idle timeout and set it to 15 minutes.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | DISA.V-270200 |
| Severity | Medium |
| Suite | DISA |
| Product | Microsoft 365 |
| Related products | Entra ID |
| Feature | Organization settings |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1550.004 Web Session Cookie |
| Supports benchmark | DISA Microsoft Entra ID STIG (version V1R2), requirement V-270200 |
| Supports controls | disa-stig-entra-id:V-270200, nist-800-53-r5:AC-11, nist-800-53-r5:AC-12 |
| PowerShell test | Test-MtDisaEntraIdleSessionTimeout |
| Services | Graph |
| Lifecycle | Preview |
Source
Section titled “Source”- Test:
tests/disa/Test.DISA.V-270200.ps1 - Documentation:
tests/disa/Test.DISA.V-270200.md