# Microsoft Intune service must initiate a session lock after a 15-minute period of inactivity

The Microsoft 365 idle session timeout signs users out of Microsoft 365 web apps after 15 minutes of inactivity or less (DISA Microsoft Intune MDM Service…

Source: https://maester.dev/docs/tests/DISA.V-273867

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/merill" title="Merill Fernando · Original author"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/merill">Merill Fernando</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/disa">DISA</a> · Microsoft 365 · Organization settings · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId DISA.V-273867 -IncludePreview
```

## Overview

The Microsoft 365 idle session timeout signs users out of Microsoft 365 web apps after 15 minutes of inactivity or less (DISA Microsoft Intune MDM Service Desktop and Mobile STIG, V-273867, CAT II).

A browser session left open on an unattended computer can be used by anyone who sits down at it. The idle session timeout signs a user out of Outlook on the web, SharePoint, OneDrive and the other Microsoft 365 web apps, including the admin centers, after a period without activity. DISA asks for 15 minutes or less, which is shorter than the CIS benchmark's three hours.

The setting is stored as the tenant's activity-based timeout policy. Its check (`MaximumIdleTimeoutMinutes`, 15 by default) passes when that policy sets a timeout of no more than the allowed number of minutes. [CIS.M365.1.3.2](https://maester.dev/docs/tests/CIS.M365.1.3.2) reads the same policy with a limit in hours and also requires a Conditional Access policy for unmanaged devices, which this STIG does not ask for.

#### Remediation action

1. In the [Microsoft 365 admin center](https://admin.microsoft.com), go to **Settings** > **Org settings** > **Security & privacy** > **[Idle session timeout](https://admin.microsoft.com/#/Settings/SecurityPrivacy/:/Settings/L1/IdleSessionTimeout)**.
2. Turn on **Turn on to set the period of inactivity for users to be signed off of Microsoft 365 web apps**.
3. Choose **Custom** and set the period to **15 minutes**.
4. Select **Save**.

#### Related links

* [DISA Microsoft Intune MDM Service Desktop and Mobile STIG: V-273867](https://cyber.trackr.live/stig/Intune_MDM_Service_Desktop_&_Mobile/1/2/V-273867)
* [Idle session timeout for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/manage/idle-session-timeout-web-apps)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | DISA.V-273867 |
| Severity | Medium |
| Suite | DISA |
| Product | Microsoft 365 |
| Related products | Entra ID |
| Feature | Organization settings |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1550.004 Web Session Cookie |
| Supports benchmark | DISA Microsoft Intune MDM Service Desktop and Mobile STIG (version V1R2), requirement V-273867 |
| Supports controls | disa-stig-intune-mdm:V-273867, nist-800-53-r5:AC-11, nist-800-53-r5:AC-12 |
| PowerShell test | [Test-MtDisaIdleSessionTimeout](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-273867.ps1) |
| Services | Graph |
| Lifecycle | Preview |

</details>

## Source

- Test: [`tests/disa/Test.DISA.V-273867.ps1`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-273867.ps1)
- Documentation: [`tests/disa/Test.DISA.V-273867.md`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-273867.md)