Microsoft Intune service must initiate a session lock after a 15-minute period of inactivity
Part of DISA · Microsoft 365 · Organization settings · All checks
Invoke-Maester -TestId DISA.V-273867 -IncludePreviewOverview
Section titled “Overview”The Microsoft 365 idle session timeout signs users out of Microsoft 365 web apps after 15 minutes of inactivity or less (DISA Microsoft Intune MDM Service Desktop and Mobile STIG, V-273867, CAT II).
A browser session left open on an unattended computer can be used by anyone who sits down at it. The idle session timeout signs a user out of Outlook on the web, SharePoint, OneDrive and the other Microsoft 365 web apps, including the admin centers, after a period without activity. DISA asks for 15 minutes or less, which is shorter than the CIS benchmark’s three hours.
The setting is stored as the tenant’s activity-based timeout policy. Its check (MaximumIdleTimeoutMinutes, 15 by default) passes when that policy sets a timeout of no more than the allowed number of minutes. CIS.M365.1.3.2 reads the same policy with a limit in hours and also requires a Conditional Access policy for unmanaged devices, which this STIG does not ask for.
Remediation action
Section titled “Remediation action”- In the Microsoft 365 admin center, go to Settings > Org settings > Security & privacy > Idle session timeout.
- Turn on Turn on to set the period of inactivity for users to be signed off of Microsoft 365 web apps.
- Choose Custom and set the period to 15 minutes.
- Select Save.
Related links
Section titled “Related links”- DISA Microsoft Intune MDM Service Desktop and Mobile STIG: V-273867
- Idle session timeout for Microsoft 365
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | DISA.V-273867 |
| Severity | Medium |
| Suite | DISA |
| Product | Microsoft 365 |
| Related products | Entra ID |
| Feature | Organization settings |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1550.004 Web Session Cookie |
| Supports benchmark | DISA Microsoft Intune MDM Service Desktop and Mobile STIG (version V1R2), requirement V-273867 |
| Supports controls | disa-stig-intune-mdm:V-273867, nist-800-53-r5:AC-11, nist-800-53-r5:AC-12 |
| PowerShell test | Test-MtDisaIdleSessionTimeout |
| Services | Graph |
| Lifecycle | Preview |
Source
Section titled “Source”- Test:
tests/disa/Test.DISA.V-273867.ps1 - Documentation:
tests/disa/Test.DISA.V-273867.md