# Microsoft Entra ID must initiate a session lock after a 15-minute period of inactivity

Idle sessions are signed out after 15 minutes of inactivity or less. (DISA Microsoft Entra ID STIG, V-270200, CAT II).

Source: https://maester.dev/docs/tests/DISA.V-270200

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/merill" title="Merill Fernando · Original author"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/merill">Merill Fernando</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/disa">DISA</a> · Microsoft 365 · Organization settings · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId DISA.V-270200 -IncludePreview
```

## Overview

Idle sessions are signed out after 15 minutes of inactivity or less. (DISA Microsoft Entra ID STIG, V-270200, CAT II).

A session left open on an unattended computer can be used by anyone who sits down at it. DISA asks Microsoft Entra ID to lock a session after 15 minutes without activity.

The STIG's check reads the directory-level idle timeout of the Azure portal (**Settings** > **Signing out + notifications**), which has no documented API. Microsoft 365 applies its idle session timeout to the Azure portal as well, unless the portal sets its own value, so this test runs [DISA.V-273867](https://maester.dev/docs/tests/DISA.V-273867), which reads that timeout, with a maximum of 15 minutes. Check the portal setting by hand if it is configured there.

#### Remediation action

1. In the [Microsoft 365 admin center](https://admin.microsoft.com), go to **Settings** > **Org settings** > **Security & privacy** > **[Idle session timeout](https://admin.microsoft.com/#/Settings/SecurityPrivacy/:/Settings/L1/IdleSessionTimeout)**.
2. Turn on **Turn on to set the period of inactivity for users to be signed off of Microsoft 365 web apps**.
3. Choose **Custom**, set the period to **15 minutes** and select **Save**.
4. In the [Azure portal](https://portal.azure.com), select the gear icon > **Signing out + notifications**, select **Enable directory level idle timeout** and set it to **15 minutes**.

#### Related links

* [DISA Microsoft Entra ID STIG: V-270200](https://cyber.trackr.live/stig/Entra_ID/1/2/V-270200)
* [Idle session timeout for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/manage/idle-session-timeout-web-apps)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | DISA.V-270200 |
| Severity | Medium |
| Suite | DISA |
| Product | Microsoft 365 |
| Related products | Entra ID |
| Feature | Organization settings |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1550.004 Web Session Cookie |
| Supports benchmark | DISA Microsoft Entra ID STIG (version V1R2), requirement V-270200 |
| Supports controls | disa-stig-entra-id:V-270200, nist-800-53-r5:AC-11, nist-800-53-r5:AC-12 |
| PowerShell test | [Test-MtDisaEntraIdleSessionTimeout](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270200.ps1) |
| Services | Graph |
| Lifecycle | Preview |

</details>

## Source

- Test: [`tests/disa/Test.DISA.V-270200.ps1`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270200.ps1)
- Documentation: [`tests/disa/Test.DISA.V-270200.md`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270200.md)