TMA-POWERPLATFORM-1.2
Ensure 'User sessions are terminated upon time limit exceeded and user logoff'
Описание
The Dynamics 365 platform can be configured with a user session expiration time and inactivity timeout. The recommended state for this setting is: 120 minutes. By default, the timeout for a user’s session is set to 24 hours which means the user is not required to re-enter their login details for up to 24 hours. Whenever a Dynamics 365 user sessions is started, a unique session ID and other session information are generated. Such information can be used be a malicious user to hijack the session. By terminating sessions upon user logoff and idle time limit, the underlying session information is invalidated. Therefore, the potential for the session to be hijacked is removed.
Как проверяется
Метод проверки: Ручная проверка
Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.
Verify that user sessions are terminated upon user logoff and when the idle time limit is exceeded. In the Power Platform Admin Center: 1. Log in to https://admin.powerplatform.microsoft.com and select the appropriate environment. 2. Select Settings. 3. Expand Product then select Privacy + Security. 4. Under Session Expiration ensure the slider is set to On. Confirm the length and timeout as determined by organizational policy. 5. Under Inactivity timeout ensure the slider is set to On. Confirm the duration for timeout and warning as determined by your organization. 6. Click Save.
Как исправляется
Метод исправления: Рекомендация или патч инфраструктуры
Ensure that user sessions are terminated upon user logoff and when the idle time limit is exceeded. In the Power Platform Admin Center: 1. Log in to https://admin.powerplatform.microsoft.com and select the appropriate environment. 2. Select Settings. 3. Expand Product then select Privacy + Security. 4. Under Session Expiration move the slider to On. - Enter the session length and timeout as determined by organizational policy 5. Under Inactivity timeout move the slider to On. - Enter the duration for timeout and warning as determined by organizational policy. 6. Click Save. Note: These settings apply to all users in the environment.
Свойства
- Операционные системы
- Любая
- Теги
- loggingpower-platformsaas
- Источник
- CIS Microsoft Dynamics 365 Power Platform Benchmark v1.0.1 - 1.2 Ensure 'User sessions are terminated upon time limit exceeded and user logoff'