{
  "id": "CB-M365-AUTH-027",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-027",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-027.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-027.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-027",
    "title": "Hide the \"Stay signed in\" option at sign-in",
    "finding": {
      "title": "Users can choose to keep a persistent sign-in session in the browser",
      "description": "Answering yes to \"Stay signed in?\" writes a persistent cookie, so the session survives browser restarts on any device, including shared ones."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "session",
      "kmsi",
      "persistent-session",
      "browser"
    ],
    "description": "The tenant-wide **Show keep user signed in** setting is set to **No**. Users no longer see the\n**Stay signed in?** prompt after signing in, and Microsoft Entra ID issues a session cookie that\nends when the browser is closed instead of a persistent one.\n",
    "rationale": "A persistent sign-in cookie is the easiest session to steal or reuse: it stays on the disk of\nwhatever device the user signed in from, including home and shared computers, and it bypasses the\nidle session timeout (CB-M365-AUTH-026). Removing the choice means a closed browser ends the\nsession.\n",
    "impact": "Users are asked to sign in more often in the browser on devices without single sign-on. Microsoft\nnotes that some older SharePoint and Office 2010 features rely on the option and can show extra\nprompts. Single sign-on on Microsoft Entra joined or hybrid joined devices is not affected.\n",
    "notes": "For a finer scope, the Conditional Access session control **Persistent browser session** set to\n**Never persistent** removes the prompt for selected users only; CB-M365-AUTH-024 uses it for\nadministrators.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Users > User settings > Show keep user signed in",
      "default_value": "Yes",
      "recommended_value": "No"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Users** > **User settings**.\n3. Check that **Show keep user signed in** is set to **No**.\n4. Fail if it is set to **Yes**.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as a Global Administrator (Microsoft documents\n   this role for the setting).\n2. Browse to **Entra ID** > **Users** > **User settings**.\n3. Set **Show keep user signed in** to **No** and select **Save**.\n4. Tell users that the prompt disappears and that they may sign in more often in the browser.\n",
      "rollback": "Set **Show keep user signed in** back to **Yes**.\n"
    },
    "references": [
      {
        "title": "Manage the 'Stay signed in' prompt in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/fundamentals/how-to-manage-stay-signed-in-prompt",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Configure adaptive session lifetime policies",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-session-lifetime",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-12",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1539"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-025",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-026",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-048",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-024",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}