The settingWhat we hold this to
CreativeTechs minimum
SharePoint and OneDrive idle session sign-out enabled at 8 hours with a 5-minute warning. Deleted-user OneDrive content retained ≥ 90 days.
Benchmark position
No published figure for either in CIS M365 v6.0.1, CISA SCuBA or EIDSCA as they ran on this tenant. Huntress flags both but publishes no threshold we can see.
Where we differ, and why
Both numbers are ours and should be read that way. 8 hours is one working day — long enough that nobody notices, short enough that a walked-away browser on a shared machine dies overnight. 90 days is the Microsoft default for orphaned OneDrive and matches the audit-retention floor in CTB-09, so offboarding and investigation windows line up. If a client's insurer names a figure, theirs wins.
Where the switch is
SharePoint admin centre → Policies → Access control → Idle session sign-out. Retention: SharePoint admin centre → Settings → OneDrive retention for deleted users.
https://<tenant>-admin.sharepoint.com
How to verify
Get-SPOTenant | fl OrphanedPersonalSitesRetentionPeriod # expect 90 or more Idle session sign-out: SharePoint admin centre → Access control (no stable cmdlet)
- Why it matters
- Idle session timeout limits a walked-away browser on a shared machine; 90-day OneDrive retention means an offboarded person's files survive someone deleting the account too eagerly.
- How we check
- Huntress 'Idle session timeout' and 'Deleted user OneDrive content retained 90 days' (Medium–Low · Standard).
- Fix — M365
- SharePoint admin → idle session sign-out; set OneDrive orphaned-content retention to 90 days or more.
- Fix — Google
- Google session control; Vault retention rules.
- User notices
- People get signed out of SharePoint after a period of inactivity.
- Expected pushback
- Mild. Set the timeout generously — a working day, not twenty minutes — and nobody notices.