Require users to sign in again at least every {{ user_signin_frequency_days }} days

Description

A Conditional Access policy applies the Sign-in frequency session control to all users on all resources, with a periodic reauthentication of at most {{ user_signin_frequency_days }} days. Without such a policy, Microsoft Entra ID uses a rolling 90-day window: a session is renewed as long as it is used, and the user is not asked to authenticate again.

Administrators get a shorter frequency from CB-M365-AUTH-024; this control covers everyone else. It excludes only the emergency access accounts.

Sign-in frequency applies to interactive sign-ins and to refresh tokens. It does not apply to service principals or managed identities. If several policies set a frequency, the shortest one wins.

Rationale

Token theft (infostealer malware, adversary-in-the-middle phishing, a lost unlocked device) gives an attacker a session that survives a password change only until the next forced sign-in. A periodic reauthentication caps how long a stolen refresh token or browser session stays useful, and makes the user prove again that they hold the password and the MFA method.

Impact

Users are prompted to sign in and complete MFA once every {{ user_signin_frequency_days }} days on each device and application. On Microsoft Entra joined or hybrid joined Windows devices with Windows Hello for Business the prompt is usually silent. Shorter values cause MFA fatigue and help-desk calls.

Applies when

Requires: Microsoft Entra ID P1

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
2. Browse to Entra ID > Conditional Access > Policies.
3. Find a policy with State set to On where:
   • Users > Include is All users, and Exclude contains only the emergency access accounts or their group;
   • Target resources includes All resources, without exclusions;
   • Session > Sign-in frequency is enabled, Periodic reauthentication, with a value of {{ user_signin_frequency_days }} days or less (or the equivalent in hours).
4. Alternative in PowerShell (Microsoft Graph, scope Policy.Read.All): Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.SessionControls.SignInFrequency.IsEnabled } | Select-Object DisplayName, State, @{n='Frequency';e={$_.SessionControls.SignInFrequency.Value, $_.SessionControls.SignInFrequency.Type}}
5. Fail if no enabled policy covers all users and all resources with a frequency of {{ user_signin_frequency_days }} days or less.

Remediation

1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
2. Browse to Entra ID > Conditional Access > Policies and select New policy.
3. Name it, for example ALL - Sign-in frequency.
4. Users > Include: All users. Exclude: the emergency access accounts.
5. Target resources > Resources > Include: All resources.
6. Session > Sign-in frequency > Periodic reauthentication: enter {{ user_signin_frequency_days }} and select Days.
7. Set Enable policy to Report-only, save, and check the sign-in logs for a few days.
8. Switch Enable policy to On.

The same policy can be created with New-MgIdentityConditionalAccessPolicy and a sessionControls.signInFrequency block (value, type: days, isEnabled: true).

Rollback

Set the policy to Report-only or Off.

References

• Configure adaptive session lifetime policies Microsoft, vendor-doc, accessed 2026-10-24
• Conditional Access adaptive session lifetime Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-026 Sign out idle Microsoft 365 web sessions on unmanaged devices after {{ idle_timeout_hours }} hours
• related CB-M365-AUTH-027 Hide the "Stay signed in" option at sign-in
• related CB-M365-AUTH-028 Require a fresh sign-in with MFA for every Intune device enrollment
• related CB-M365-AUTH-024 Limit administrator sessions with sign-in frequency and non-persistent browsers
• related CB-M365-AUTH-003 Require MFA for all users on all resources

People and lifecycle