Ensure 'User sessions are terminated upon time limit exceeded and user logoff'

MédiaNível 1Revisão manualpower-platform

Descrição

The Dynamics 365 platform can be configured with a user session expiration time and inactivity timeout. The recommended state for this setting is: 120 minutes. By default, the timeout for a user’s session is set to 24 hours which means the user is not required to re-enter their login details for up to 24 hours. Whenever a Dynamics 365 user sessions is started, a unique session ID and other session information are generated. Such information can be used be a malicious user to hijack the session. By terminating sessions upon user logoff and idle time limit, the underlying session information is invalidated. Therefore, the potential for the session to be hijacked is removed.

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

Verify that user sessions are terminated upon user logoff and when the idle time limit is exceeded. In the Power Platform Admin Center: 1. Log in to https://admin.powerplatform.microsoft.com and select the appropriate environment. 2. Select Settings. 3. Expand Product then select Privacy + Security. 4. Under Session Expiration ensure the slider is set to On. Confirm the length and timeout as determined by organizational policy. 5. Under Inactivity timeout ensure the slider is set to On. Confirm the duration for timeout and warning as determined by your organization. 6. Click Save.

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Ensure that user sessions are terminated upon user logoff and when the idle time limit is exceeded. In the Power Platform Admin Center: 1. Log in to https://admin.powerplatform.microsoft.com and select the appropriate environment. 2. Select Settings. 3. Expand Product then select Privacy + Security. 4. Under Session Expiration move the slider to On. - Enter the session length and timeout as determined by organizational policy 5. Under Inactivity timeout move the slider to On. - Enter the duration for timeout and warning as determined by organizational policy. 6. Click Save. Note: These settings apply to all users in the environment.

Propriedades

Sistemas operacionais: Qualquer
Tags: loggingpower-platformsaas
Referência: CIS Microsoft Dynamics 365 Power Platform Benchmark v1.0.1 - 1.2 Ensure 'User sessions are terminated upon time limit exceeded and user logoff'