Check ID: entra_admin_users_sign_in_frequency_enabled
Provider: Microsoft 365
Service: entra
Severity: HIGH
Categories: identity-access, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Entra Conditional Access evaluates whether admin roles are covered by policies that enforce a defined sign-in frequency and non-persistent browser sessions across all cloud apps. It looks for reauthentication set to a time interval or Every time, persistent browser set to never, and policies that are enforced rather than report-only or disabled.

​
Risk

Lax reauthentication and persistent sessions let admin tokens live too long, enabling session hijacking, token replay, and access after credential theft. Attackers can modify configurations, elevate privileges, and exfiltrate data, threatening confidentiality and integrity and increasing risk of tenant takeover.

​
Recommendation

Use Conditional Access for admin roles to:
  • Enforce short sign-in frequency (e.g., 4 hours, or Every time for critical actions)
  • Set persistent browser to never
  • Cover all apps and run in enforce mode
Pair with least privilege, MFA, PIM, and token protection to reduce session abuse.

​
Remediation

resource "azuread_conditional_access_policy" "<example_resource_name>" {
  display_name = "<example_resource_name>"
  state        = "enabled" # Critical: must be enabled (not report-only) to enforce

  conditions {
    users {
      included_roles = ["<example_role_id>"] # Critical: target admin directory roles (e.g., Global Administrator)
    }
    applications {
      included_applications = ["All"] # Critical: apply to all cloud apps
    }
  }

  session_controls {
    sign_in_frequency          = 4          # Critical: enforce reauth at or below 4 hours
    sign_in_frequency_interval = "hours"   # Critical: time-based frequency in hours
    persistent_browser_mode    = "never"   # Critical: enforce non-persistent browser sessions
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_admin_users_sign_in_frequency_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks