EIDCA-014: Session Controls Audit
- Platform
- Entra ID / M365
- Category
- Entra ID Conditional Access
- Severity
- Medium
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Conditional Access session controls govern sign-in frequency and browser session persistence. Without proper session controls, users may remain authenticated indefinitely, increasing the window of opportunity for session hijacking and token theft attacks.
Recommended value
Sign-in frequency set to no more than 24 hours for sensitive applications with persistent browser sessions disabled
Remediation
Review Conditional Access policies for session control configurations including sign-in frequency and persistent browser session settings. Configure sign-in frequency to appropriate intervals based on application sensitivity, with shorter intervals for privileged access. Disable persistent browser sessions for sensitive applications to ensure tokens expire and require re-authentication.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-12, SC-10
- CIS M365 Benchmark
- 5.2.2.6