Hide the "Stay signed in" option at sign-in

Description

The tenant-wide Show keep user signed in setting is set to No. Users no longer see the Stay signed in? prompt after signing in, and Microsoft Entra ID issues a session cookie that ends when the browser is closed instead of a persistent one.

For a finer scope, the Conditional Access session control Persistent browser session set to Never persistent removes the prompt for selected users only; CB-M365-AUTH-024 uses it for administrators.

Rationale

A persistent sign-in cookie is the easiest session to steal or reuse: it stays on the disk of whatever device the user signed in from, including home and shared computers, and it bypasses the idle session timeout (CB-M365-AUTH-026). Removing the choice means a closed browser ends the session.

Impact

Users are asked to sign in more often in the browser on devices without single sign-on. Microsoft notes that some older SharePoint and Office 2010 features rely on the option and can show extra prompts. Single sign-on on Microsoft Entra joined or hybrid joined devices is not affected.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Users > User settings.
3. Check that Show keep user signed in is set to No.
4. Fail if it is set to Yes.

Remediation

1. Sign in to the Microsoft Entra admin center as a Global Administrator (Microsoft documents this role for the setting).
2. Browse to Entra ID > Users > User settings.
3. Set Show keep user signed in to No and select Save.
4. Tell users that the prompt disappears and that they may sign in more often in the browser.

Rollback

Set Show keep user signed in back to Yes.

References

• Manage the 'Stay signed in' prompt in Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24
• Configure adaptive session lifetime policies Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-025 Require users to sign in again at least every {{ user_signin_frequency_days }} days
• related CB-M365-AUTH-026 Sign out idle Microsoft 365 web sessions on unmanaged devices after {{ idle_timeout_hours }} hours
• related CB-M365-AUTH-048 Display a legal notice on the sign-in page
• related CB-M365-AUTH-024 Limit administrator sessions with sign-in frequency and non-persistent browsers

People and lifecycle