Microsoft 365
TMA-M365-5.1.2.5
Ensure the option to remain signed in is hidden
Descripción
The option for the user to Stay signed in, or the Keep me signed in option, will prompt a user after a successful login. When the user selects this option, a persistent refresh token is created. The refresh token lasts for 90 days by default and does not prompt for sign-in or multifactor. Allowing users to select this option presents risk, especially if the user signs into their account on a publicly accessible computer/web browser. In this case it would be trivial for an unauthorized person to gain access to any associated cloud data from that account.
Cómo se verifica
Método de auditoría: Revisión manual
To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Users and select User settings. 3. Verify that Show keep user signed in is highlighted No.
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Users and select User settings. 3. Set Show keep user signed in to No. 4. Click Save.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- m365saas
- Referencia
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.1.2.5 Ensure the option to remain signed in is hidden