The settingWhat we hold this to
CreativeTechs minimum
A CA policy in state ENABLED on directory roles → Session → Sign-in frequency = 12 hours, Persistent browser session = Never. Regular users are NOT in scope.
Benchmark position
Microsoft recommends disabling browser persistence for unmanaged-device access (Maester MT.1018 cites the CA template). No published hour figure in CIS, CISA or EIDSCA.
Where we differ, and why
The 12-hour figure is ours — it is one working day, so an admin re-authenticates roughly at each start of day rather than mid-task. Shorter is defensible for higher-risk tenants; applying any of it to regular users is where the revolt comes from.
Where the switch is
Entra admin centre → Protection → Conditional Access → Policies → the admin policy → Session → Sign-in frequency / Persistent browser session.
How to verify
Graph: /identity/conditionalAccess/policies → sessionControls.signInFrequency.value eq 12, type eq 'hours'; persistentBrowser.mode eq 'never'
- Why it matters
- Caps the useful life of a stolen token. The control that most directly shortens the window ITDR has to catch something in.
- How we check
- Maester MT.1018.
- Fix — M365
- CA policy on directory roles → Session → sign-in frequency 12 hours, persistent browser session = Never.
- Fix — Google
- Admin → Security → Google session control → web session length for admins.
- User notices
- Admins re-authenticate roughly twice a day.
- Expected pushback
- Mild grumbling, mostly from us. Do NOT apply to all users — that is precisely where a revolt comes from.
- Reason on file
- Admins only — never apply to all users.