| name | cis-azure-foundations-5.9 |
| description | Ensure 'Number of days before users are asked to re-confirm their authentication information' is not set to '0' |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","identity","authentication","password-reset","registration"] |
| cis_id | 5.9 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-5.5","cis-azure-foundations-5.10"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure 'Number of days before users are asked to re-confirm their authentication information' is not set to '0'
Description
Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0.
Rationale
This setting is necessary if 'Require users to register when signing in' is enabled. If authentication re-confirmation is disabled, registered users will never be prompted to re-confirm their existing authentication information. If the authentication information for a user changes, such as a phone number or email, then the password reset information for that user reverts to the previously registered authentication information.
Impact
Users will be prompted to re-confirm their authentication information after the number of days specified.
Audit Procedure
Using Azure Portal
- From Azure Home select the Portal Menu.
- Select
Microsoft Entra ID.
- Under
Manage, select Users.
- Select
Password reset.
- Under
Manage, select Registration.
- Ensure that
Number of days before users are asked to re-confirm their authentication information is not set to 0.
Expected Result
Number of days before users are asked to re-confirm their authentication information should not be 0. A value such as 180 days is recommended.
Remediation
Using Azure Portal
- From Azure Home select the Portal Menu.
- Select
Microsoft Entra ID.
- Under
Manage, select Users.
- Select
Password reset.
- Under
Manage, select Registration.
- Set the
Number of days before users are asked to re-confirm their authentication information to your organization-defined frequency.
- Click
Save.
Default Value
By default, the Number of days before users are asked to re-confirm their authentication information is set to "180 days".
References
- https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks#registration
