What this check looks at
Checks for an enabled Conditional Access policy that makes administrators sign in again at least every four hours and never keeps their browser session.
Two Conditional Access session controls decide how long a sign-in lasts. Sign-in frequency sets how often a person must sign in again; Persistent browser session decides whether the browser keeps them signed in after it is closed. Without them, Entra ID keeps people signed in on a rolling window of up to 90 days, and a browser keeps the session if the person chose to stay signed in.
The check, for tenants with Entra ID P1, looks for an enabled policy that covers every administrator role in its list (or All users), targets All resources, sets sign-in frequency to four hours or less (or every time), and sets persistent browser session to Never persistent. It warns when such a policy is only in report-only mode and fails when there is none.
Modern phishing steals session cookies as well as passwords: an adversary-in-the-middle kit captures the cookie after the administrator completes MFA and replays it from the attacker’s machine, and malware on a device does the same from the browser profile. A session that lasts days gives the attacker days; a four-hour limit and no persistent cookie shrink that to hours.
Why it matters
A stolen session cookie lets an attacker act as the person without a password or MFA. For administrators, a short sign-in frequency and no persistent browser session limit how long a stolen session is any use.
An MSP engineer signs in to a client’s Entra admin centre on a laptop that later turns out to carry an information stealer. It exports the browser’s cookies, including a persistent admin session, and sells them. Days later someone uses the cookie to act as that administrator with no password or MFA. A four-hour sign-in frequency and no persistent session would have made the cookie useless long before it was sold.
For administrators, signing in again every few hours costs a few seconds with a passkey or Authenticator. Set against what an admin session can do in a tenant, it is one of the cheapest controls available.
The CIS Microsoft 365 Foundations Benchmark (5.2.2.4) asks for administrators’ sign-in frequency to be limited and their browser sessions not to persist. The rule maps to NIST CSF 2.0 PR.AA-03.
How to fix it
Where: Entra admin centre → Protection → Conditional Access
Before you start
- Confirm two emergency access (break-glass) accounts exist and exclude them from the policy, so a mistake cannot lock every administrator out.
- Tell administrators they will sign in again every few hours, and that the browser will not keep them signed in.
- Create the policy in report-only mode first and review its results in Entra ID sign-in logs (Conditional Access tab) for at least a week.
Step by step
- Tell administrators what will change. Explain to administrators that they will sign in again every four hours or less, and that closing the browser ends the session. Ask them to use a passkey or Authenticator so signing in again is quick.
- Create the policy and choose the roles. In the Microsoft Entra admin centre, go to Entra ID > Conditional Access > Policies > New policy, named "CA – Admin roles – Sign-in every 4 hours". Under Users, choose Directory roles and tick Global, Privileged Role, Security, Conditional Access, Exchange, SharePoint, User, Helpdesk, Authentication, Application, Cloud Application and Billing Administrator; exclude the emergency access group. Under Target resources, include All resources.
- Set the session controls, in report-only mode. Leave Grant unset; the MFA policy for administrators already asks for MFA. Under Session, tick Sign-in frequency, choose Periodic reauthentication and enter 4 hours (or fewer); tick Persistent browser session and choose Never persistent. Set Enable policy to Report-only and select Create.
- Check it and switch it on. After a day or two, check the Report-only tab on a few administrators’ sign-ins in Entra ID > Monitoring & health > Sign-in logs, then set Enable policy to On and select Save.
- Confirm. Open the policy and check it shows On, the administrator roles, All resources, sign-in frequency of 4 hours or less and Never persistent. Re-run the assessment to confirm the finding passes.
What users will notice
Administrators sign in again every four hours or less, and their browser no longer keeps them signed in after it closes.
How to confirm it worked
The policy is On, targets the administrator roles and all resources, and shows sign-in frequency 4 hours (or less) and persistent browser session Never persistent.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.c Privileged user management |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(j) Multi-factor authentication and secured communications |
| Microsoft Cloud Security Benchmark | IM-7 Restrict resource access based on conditions |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.8.2 Privileged access rightsA.8.5 Secure authentication |
| CIS M365 | 5.2.2.4 Ensure sign-in frequency is enabled and browser sessions are not persistent for administrative users |
| CIS Controls v8.1 | 6.5 Require MFA for administrative access (IG1) |
| NIST CSF 2.0 | PR.AA-03: Users, services, and hardware are authenticated |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Configure sign-in frequency and persistent browser sessions (Microsoft Learn)