Back to Checks
m365

Idle session timeout of 3 hours or less is configured

entra_idle_session_timeout_configured
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

An activity-based timeout policy should sign out inactive users from Microsoft 365 web apps after a period of inactivity. The web session idle timeout (WebSessionIdleTimeout) should be set to 3 hours or less so that unattended sessions are terminated.

Prowler logoProwlerprowler-provider-m365

Risk

Without an idle session timeout, an unattended and unlocked session on a shared or public device remains authenticated indefinitely, allowing anyone with physical access to act as the signed-in user.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_idle_session_timeout_configured

Recommendation

Configure an idle session timeout of 3 hours or less so inactive users are automatically signed out of Microsoft 365 web apps.

Remediation

Other

1Navigate to the Microsoft 365 admin center at https://admin.microsoft.com/
2Go to **Settings** > **Org settings** > **Security & Privacy** > **Idle session timeout**
3Turn on the setting and set the period of inactivity to **3 hours** or less
4Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client

# CIS recommends an idle session timeout of 3 hours or less.
MAX_IDLE_TIMEOUT_SECONDS = 3 * 60 * 60


class entra_idle_session_timeout_configured(Check):
    """Check if an idle session timeout of 3 hours or less is configured.

    An activity-based timeout policy should sign out inactive users from Microsoft
    365 web apps after a period of inactivity. The web session idle timeout should be
    set to 3 hours or less.

    - PASS: An activity-based timeout policy enforces an idle timeout of 3 hours or
      less.
    - FAIL: No activity-based timeout policy enforces an idle timeout of 3 hours or
      less.
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the idle session timeout policy check.

        Returns:
            A list of reports for the collected activity-based timeout policies.
        """
        findings = []
        policies = entra_client.activity_based_timeout_policies

        if not policies:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource={},
                resource_name="Activity Based Timeout Policies",
                resource_id="activityBasedTimeoutPolicies",
            )
            report.status = "FAIL"
            report.status_extended = (
                "No activity-based timeout policy enforces an idle session timeout of "
                "3 hours or less."
            )
            findings.append(report)
            return findings

        for policy in policies:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=policy,
                resource_name=policy.display_name or "Activity Based Timeout Policy",
                resource_id=policy.id,
            )
            timeout = policy.web_session_idle_timeout_seconds
            if timeout is not None and timeout <= MAX_IDLE_TIMEOUT_SECONDS:
                report.status = "PASS"
                report.status_extended = (
                    f"Activity-based timeout policy '{policy.display_name or policy.id}' "
                    f"enforces an idle session timeout of {timeout // 60} minutes and "
                    f"{timeout % 60} seconds."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Activity-based timeout policy '{policy.display_name or policy.id}' "
                    "does not enforce an idle session timeout of 3 hours or less."
                )
            findings.append(report)

        return findings

References