Session Control

CIS - Require periodic reauthentication for all users

Sign-in frequency enforced

About this policy

The CIS - Require periodic reauthentication for all users policy enforces a seven-day sign-in frequency for all users across all cloud apps. After a session exceeds seven days, users are prompted to re-authenticate. This limits how long an active session can persist without re-verification, which reduces the risk from long-lived tokens on devices that may have been compromised or left unattended. It is a sensible baseline that balances improved security with a reasonable impact on day-to-day users.

Policy conditions

Users: All users
Apps: All cloud apps

JSON template

{
  "templateId": null,
  "displayName": "CIS - Require periodic reauthentication for all users",
  "modifiedDateTime": null,
  "state": "enabledForReportingButNotEnforced",
  "deletedDateTime": null,
  "grantControls": null,
  "partialEnablementStrategy": null,
  "conditions": {
    "userRiskLevels": [],
    "signInRiskLevels": [],
    "clientAppTypes": [
      "all"
    ],
    "platforms": null,
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "includeApplications": [
        "All"
      ],
      "excludeApplications": [],
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "includeUsers": [
        "All"
      ],
      "excludeUsers": [],
      "includeGroups": [],
      "excludeGroups": [],
      "includeRoles": [],
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    }
  },
  "sessionControls": {
    "disableResilienceDefaults": null,
    "applicationEnforcedRestrictions": null,
    "cloudAppSecurity": null,
    "persistentBrowser": null,
    "continuousAccessEvaluation": null,
    "secureSignInSession": null,
    "blockSensitiveActions": null,
    "signInFrequency": {
      "value": 7,
      "type": "days",
      "authenticationType": "primaryAndSecondaryAuthentication",
      "frequencyInterval": "timeBased",
      "isEnabled": true
    }
  },
  "Tag": "CIS",
  "summary": "The CIS - Require periodic reauthentication for all users policy enforces a seven-day sign-in frequency for all users across all cloud apps. After a session exceeds seven days, users are prompted to re-authenticate. This limits how long an active session can persist without re-verification, which reduces the risk from long-lived tokens on devices that may have been compromised or left unattended. It is a sensible baseline that balances improved security with a reasonable impact on day-to-day users."
}