Detections
Analytics
5.2.2.13 Ensure that periodic reauthentication is required for all users
Information
Sign-in frequency defines the time period before a user is asked to sign in again when attempting to access a resource. The Microsoft Entra ID default configuration for user sign-in frequency is a rolling window of 90 days.The recommended state for all users is to enforce periodic reauthentication for 7 days or less.
A 7-day interval balances security and user experience by reducing the maximum lifespan of compromised credentials or stolen tokens without introducing excessive reauthentication prompts that can increase phishing susceptibility and user fatigue.
Solution
To remediate using the UI:- Navigate to the Microsoft Entra admin center https://entra.microsoft.com.
- Expand Entra ID > Conditional Access and select Policies.
- Create a new policy by selecting New policy.
- Under Users or agents (Preview) include All users.
- Under Target resources verify Resources (formerly cloud apps) include All resources (formerly 'All cloud apps').
- Under Exclude exclude any break-glass accounts.
- Under Session select Sign-in frequency and set Periodic reauthentication to 7 days or less.
- Under Enable policy set it to Report-only.
- Click Create.
- After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On.
Impact:
Most users will not find weekly reauthentication requirements disruptive. Organizations with legacy applications, custom authentication workflows, or users relying on long-running sessions (such as shared or kiosk devices) may need to evaluate compatibility and apply appropriate exclusions to prevent user disruption.
See Also
Item Details
Audit Name: CIS Microsoft 365 Foundations v7.0.0 L1 E3
Category: ACCESS CONTROL
References: 800-53|AC-2(5), 800-53|AC-11, 800-53|AC-11(1), 800-53|AC-12
Plugin: microsoft_azure
Control ID: d97ae95c71bf9652a28469a29326edafcf2df404147bcaf432fbaa25c3b73d95