Description:
Idle session timeout automatically signs out users from Microsoft 365 web apps after a set period of inactivity.
Why use it?
Enhanced Security: Reduces the risk of unauthorized access to data.
Data Protection: Safeguards sensitive information when a device is left unattended.
Compliance: Helps meet regulatory requirements for session management.
Mitigates Risks: Lowers the chance of session hijacking.
Why:
Session lifetimes are an important component in balancing security and the number of times users are prompted for their credentials.
Configured: This setting is in place.
Not Configured: This setting is not in place.
Scoring: Contributes up to 1 point to the Posture Recommendations score.
Category: General
Microsoft Licensing: Works with Basic licensing
Secure Score Impact: YES — Microsoft Secure Score control spo_idle_session_timeout.
Remediation in Augmentt: Configure directly in Augmentt (Configure tab)
Compliance Frameworks:
NIST CSF 2.0 — PR.AA-05
CIS Microsoft 365 Benchmark v6 (Level 2) — 1.3.2
CIS Microsoft 365 Benchmark v7 (Level 2) — 1.3.2
HIPAA Security Rule — 164.312(a)(2)(iii)
CMMC Level 2 — AC.L2-3.1.11, SC.L2-3.13.9
Microsoft documentation: