Limit administrator sessions with sign-in frequency and non-persistent browsers

Description

A Conditional Access policy for the privileged directory roles (the same list as CB-M365-AUTH-004), on All resources, sets two session controls: Sign-in frequency to Periodic reauthentication every {{ admin_signin_frequency_hours }} hours or less, and Persistent browser session to Never persistent.

The policy excludes only the emergency access accounts.

The persistent browser setting requires the policy to target all resources. With Privileged Identity Management, the policy applies while the role is active; PIM activation duration is another lever.

Rationale

Stolen session cookies bypass MFA until the session ends. Short administrator sessions limit how long a stolen cookie or an unlocked workstation can be used, and a non-persistent browser session ends when the browser closes.

Impact

Administrators are asked to sign in again every {{ admin_signin_frequency_hours }} hours and after closing the browser. With phishing-resistant methods such as Windows Hello for Business the prompt is light. On Entra joined devices, the primary refresh token is refreshed every four hours, so a lower frequency may not prompt as often as expected.

Applies when

Requires: Microsoft Entra ID P1

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
2. Browse to Entra ID > Conditional Access > Policies.
3. Find a policy with State set to On where Users includes the privileged directory roles of CB-M365-AUTH-004 (only emergency access accounts excluded), Target resources includes All resources, and Session has Sign-in frequency set to Periodic reauthentication at {{ admin_signin_frequency_hours }} hours or less and Persistent browser session set to Never persistent. Both settings can sit in two policies with the same scope.
4. Read-only alternative with Microsoft Graph PowerShell (scope Policy.Read.All): Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.Users.IncludeRoles } | Select-Object DisplayName, State, @{n='SIF';e={"$($_.SessionControls.SignInFrequency.Value) $($_.SessionControls.SignInFrequency.Type)"}}, @{n='Persistent';e={$_.SessionControls.PersistentBrowser.Mode}}
5. Fail if no such policy exists, if it is Report-only or Off, if a role is missing, if the frequency is longer than {{ admin_signin_frequency_hours }} hours, or if the browser session can persist.

Remediation

1. As at least a Conditional Access Administrator, browse to Entra ID > Conditional Access > Policies and select New policy.
2. Name it, for example ADM - Session lifetime.
3. Users > Include > Directory roles: the privileged roles. Exclude: the emergency access accounts.
4. Target resources > Resources > Include: All resources.
5. Session: select Sign-in frequency, Periodic reauthentication, {{ admin_signin_frequency_hours }} Hours; select Persistent browser session, Never persistent.
6. Set Enable policy to Report-only, save, then switch to On. Graph equivalent: New-MgIdentityConditionalAccessPolicy with sessionControls.signInFrequency (value, type: hours, isEnabled: true) and sessionControls.persistentBrowser (mode: never, isEnabled: true).

Rollback

Set the policy to Report-only or Off.

References

• Configure adaptive session lifetime policies Microsoft, vendor-doc, accessed 2026-10-24
• Conditional Access adaptive session lifetime Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-004 Require phishing-resistant MFA for administrative roles
• related CB-M365-AUTH-025 Require users to sign in again at least every {{ user_signin_frequency_days }} days
• related CB-M365-AUTH-027 Hide the "Stay signed in" option at sign-in
• related CB-M365-ADMIN-002 Keep two protected emergency access accounts
• related CB-M365-AUTH-029 Require token protection for desktop access to Exchange Online, SharePoint Online and Teams

People and lifecycle