{
  "id": "CB-M365-AUTH-024",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-024",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-024.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-024.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-024",
    "title": "Limit administrator sessions with sign-in frequency and non-persistent browsers",
    "finding": {
      "title": "Administrator sessions last too long or persist in the browser",
      "description": "An administrator session that survives browser restarts and lasts for days gives a long window to anyone who steals the session cookie or uses an unattended computer."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "conditional-access",
      "session",
      "sign-in-frequency",
      "privileged-access"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P1"
      ]
    },
    "description": "A Conditional Access policy for the privileged directory roles (the same list as\nCB-M365-AUTH-004), on **All resources**, sets two session controls: **Sign-in frequency** to\n**Periodic reauthentication** every `{{ admin_signin_frequency_hours }}` hours or less, and\n**Persistent browser session** to **Never persistent**.\n\nThe policy excludes only the emergency access accounts.\n",
    "parameters": [
      {
        "name": "admin_signin_frequency_hours",
        "type": "integer",
        "unit": "hours",
        "description": "Maximum time before an administrator must sign in again.",
        "default": 4,
        "minimum": 1,
        "maximum": 24
      }
    ],
    "rationale": "Stolen session cookies bypass MFA until the session ends. Short administrator sessions limit\nhow long a stolen cookie or an unlocked workstation can be used, and a non-persistent browser\nsession ends when the browser closes.\n",
    "impact": "Administrators are asked to sign in again every `{{ admin_signin_frequency_hours }}` hours and\nafter closing the browser. With phishing-resistant methods such as Windows Hello for Business\nthe prompt is light. On Entra joined devices, the primary refresh token is refreshed every four\nhours, so a lower frequency may not prompt as often as expected.\n",
    "notes": "The persistent browser setting requires the policy to target all resources. With Privileged\nIdentity Management, the policy applies while the role is active; PIM activation duration is\nanother lever.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Entra ID** > **Conditional Access** > **Policies**.\n3. Find a policy with **State** set to **On** where **Users** includes the privileged\n   directory roles of CB-M365-AUTH-004 (only emergency access accounts excluded), **Target\n   resources** includes **All resources**, and **Session** has **Sign-in frequency** set to\n   **Periodic reauthentication** at `{{ admin_signin_frequency_hours }}` hours or less and\n   **Persistent browser session** set to **Never persistent**. Both settings can sit in two\n   policies with the same scope.\n4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n   `Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.Users.IncludeRoles } | Select-Object DisplayName, State, @{n='SIF';e={\"$($_.SessionControls.SignInFrequency.Value) $($_.SessionControls.SignInFrequency.Type)\"}}, @{n='Persistent';e={$_.SessionControls.PersistentBrowser.Mode}}`\n5. Fail if no such policy exists, if it is Report-only or Off, if a role is missing, if the\n   frequency is longer than `{{ admin_signin_frequency_hours }}` hours, or if the browser\n   session can persist.\n"
    },
    "remediation": {
      "manual": "1. As at least a Conditional Access Administrator, browse to **Entra ID** >\n   **Conditional Access** > **Policies** and select **New policy**.\n2. Name it, for example `ADM - Session lifetime`.\n3. **Users** > **Include** > **Directory roles**: the privileged roles. **Exclude**: the\n   emergency access accounts.\n4. **Target resources** > **Resources** > **Include**: **All resources**.\n5. **Session**: select **Sign-in frequency**, **Periodic reauthentication**,\n   `{{ admin_signin_frequency_hours }}` **Hours**; select **Persistent browser session**,\n   **Never persistent**.\n6. Set **Enable policy** to **Report-only**, save, then switch to **On**.\nGraph equivalent: `New-MgIdentityConditionalAccessPolicy` with\n`sessionControls.signInFrequency` (`value`, `type: hours`, `isEnabled: true`) and\n`sessionControls.persistentBrowser` (`mode: never`, `isEnabled: true`).\n",
      "rollback": "Set the policy to **Report-only** or **Off**.\n"
    },
    "references": [
      {
        "title": "Configure adaptive session lifetime policies",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-session-lifetime",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Conditional Access adaptive session lifetime",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/concept-session-lifetime",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-mfa",
        "framework_version": "2.0",
        "id": "R12",
        "relation": "related",
        "note": "ANSSI asks to limit the validity of authenticated sessions; this control does it for administrators."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-12",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-11",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1539"
      },
      {
        "framework": "mitre-attack",
        "id": "T1550.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-004",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-025",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-027",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-002",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-029",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}