Detections
Analytics
5.2.2.4 Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users
Information
In complex deployments, organizations might have a need to restrict authentication sessions. Conditional Access policies allow for the targeting of specific user accounts. Some scenarios might include:- Resource access from an unmanaged or shared device
- Access to sensitive information from an external network
- High-privileged users
- Business-critical applications
Note: This CA policy can be added to the previous CA policy in this benchmark "Ensure multifactor authentication is enabled for all users in administrative roles"
Forcing a time out for MFA will help ensure that sessions are not kept alive for an indefinite period of time, ensuring that browser sessions are not persistent will help in prevention of drive-by attacks in web browsers, this also prevents creation and saving of session cookies leaving nothing for an attacker to take.
Solution
To remediate using the UI:- Navigate to Microsoft Entra admin center https://entra.microsoft.com/.
- Expand Entra ID > Conditional Access and select Policies.
- Click New policy.
- Under Users or agents (Preview) include Select users and groups and check Directory roles.
- At a minimum, include the directory roles listed below in this section of the document.
- Under Target resources include All resources (formerly 'All cloud apps').
- Under Exclude exclude any break-glass accounts.
- Under Grant select Grant Access and check Require multifactor authentication.
- Under Session select Sign-in frequency select Periodic reauthentication and set it to 4 hours (or less).
- Check Persistent browser session then select Never persistent in the drop-down menu.
- Under Enable policy set it to Report-only.
- Click Create.
- After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On.
At minimum these directory roles should be included in the policy:
- Application administrator
- Authentication administrator
- Billing administrator
- Cloud application administrator
- Conditional Access administrator
- Exchange administrator
- Global administrator
- Global reader
- Helpdesk administrator
- Password administrator
- Privileged authentication administrator
- Privileged role administrator
- Security administrator
- SharePoint administrator
- User administrator
Impact:
Users with Administrative roles will be prompted at the frequency set for MFA.
See Also
Item Details
Audit Name: CIS Microsoft 365 Foundations v7.0.0 L1 E3
Category: ACCESS CONTROL
References: 800-53|AC-2(5), 800-53|AC-11, 800-53|AC-11(1), 800-53|AC-12
Plugin: microsoft_azure
Control ID: f63c8767b82dabe360f5677db91b968d8baadf58bf8890188e7b0fd363fbd554