What this check looks at
Checks that idle browser sessions to Microsoft 365 web apps are signed out after three hours or less, and that Conditional Access passes the timeout to Outlook and SharePoint on unmanaged devices.
Idle session timeout signs people out of Microsoft 365 web apps (Outlook on the web, OneDrive, SharePoint, Office on the web and the Microsoft 365 home page) after a period with no activity in the browser, with a warning shortly before. It is off by default, so a browser session to Outlook on the web lasts as long as the browser and its cookies do, often for days.
The check fails when no idle session timeout is set, or when it is longer than three hours. When the timeout is three hours or less, it also looks for an enabled Conditional Access policy that uses app-enforced restrictions for Office 365, Exchange Online or SharePoint Online (or all resources); with none, it warns, because the CIS benchmark pairs the timeout with that policy so that Outlook on the web and SharePoint apply it on unmanaged devices too. It passes when both are in place.
An unattended session is an open door to whoever sits down next: at a shared office PC, a hot desk, a family computer at home or a hotel business centre. They need no password and no MFA, because the session already passed both. They can read and forward mail, download files, or add a forwarding rule that keeps working long after they have gone.
Why it matters
A browser left signed in on a shared or home computer gives the next person at it the user’s mail and files. An idle timeout closes that session for them; without it, the session lasts as long as the browser does.
Think of a receptionist who checks the shared mailbox on a front-desk PC and leaves it signed in overnight, or a manager who opens Outlook on the web on a family laptop. A contractor or a curious relative can read client correspondence, download a payroll spreadsheet from OneDrive, or send a message that looks entirely genuine.
Unauthorised access of this kind to personal data is a breach the organisation may have to assess and report to the ICO under UK GDPR, and it is hard to investigate because the activity comes from a legitimate, already-authenticated session. A three-hour idle limit costs people almost nothing: an occasional sign-in after a long meeting.
The CIS Microsoft 365 Foundations Benchmark (1.3.2) asks for an idle session timeout of three hours or less for unmanaged devices, using the Microsoft 365 setting together with a Conditional Access policy that uses app-enforced restrictions. The rule maps to NIST CSF 2.0 PR.AA-03.
How to fix it
Where: Microsoft 365 admin centre → Settings → Org settings → Security & privacy
Before you start
- Agree the timeout with the business: CIS asks for three hours or less. Shared kiosks may want less.
- Create the policy in report-only mode first and review its results in Entra ID sign-in logs (Conditional Access tab) for at least a week.
Step by step
- Agree the timeout. Agree the period with the client: three hours or less, shorter for shared or front-desk PCs. Explain that people are signed out of web apps after that long without activity, with a warning first, and that the desktop and mobile apps are not affected.
- Turn on the idle session timeout. In the Microsoft 365 admin centre, go to Settings > Org settings > Security & privacy > Idle session timeout. Tick the option to turn it on, choose 3 hours (or less) and select Save.
- Create the app-enforced restrictions policy in report-only mode. In the Microsoft Entra admin centre, go to Entra ID > Conditional Access > Policies > New policy, named "CA – All users – Office 365 browser – App-enforced restrictions". Users: All users, excluding the emergency access group. Target resources: Select resources > Office 365. Conditions > Client apps: Configure Yes, tick Browser only. Session: tick Use app enforced restrictions. Set Enable policy to Report-only and select Create.
- Check it and switch it on. After a day or two, look at the Report-only tab of a few browser sign-ins in Entra ID > Monitoring & health > Sign-in logs, then set Enable policy to On and save. The policy blocks nothing by itself: it passes device information to Exchange Online and SharePoint so they can apply their own session limits.
- Test the timeout. Sign in to https://www.office.com in a browser on a test machine and leave it idle beyond the timeout (shorten the setting briefly if you want a quick test). The warning should appear, followed by sign-out.
- Confirm. Check Idle session timeout shows On with the chosen period and the Conditional Access policy shows On. Re-run the assessment: it passes when the timeout is three hours or less and an enabled policy uses app-enforced restrictions.
What users will notice
People who leave a Microsoft 365 web app idle for longer than the timeout are signed out, with a warning a minute before.
How to confirm it worked
Microsoft 365 admin centre, Org settings, Security & privacy, Idle session timeout shows On with the time chosen; the Conditional Access policy using app-enforced restrictions is On.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | IM-7 Restrict resource access based on conditions |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.8.5 Secure authentication |
| CIS M365 | 1.3.2 Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devices |
| CIS Controls v8.1 | 4.3 Configure automatic session locking on enterprise assets (IG1) |
| NIST CSF 2.0 | PR.AA-03: Users, services, and hardware are authenticated |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Idle session timeout for Microsoft 365 (Microsoft Learn)