CA-11: Enforce Session Lifetime Limits for Guests and Admins

CA-11 is a security control that guests and admins represent elevated risk. guest accounts access your data from unmanaged devices; limiting session lifetime reduces exposure if credentials are compromised. admin sessions should be short-lived. regular users on managed devices can have longer sessions to avoid productivity impact. It requires that sign-in frequency is enforced via conditional access for high-risk scenarios and guest user sessions expire within 24 hours, admin sessions expire within 8 hours, persistent browser sessions are disabled for guest access.

Guests and admins represent elevated risk. Guest accounts access your data from unmanaged devices; limiting session lifetime reduces exposure if credentials are compromised. Admin sessions should be short-lived. Regular users on managed devices can have longer sessions to avoid productivity impact.

TrueConfig provides one-click remediation for CA-11. Creates Conditional Access policies with sign-in frequency for guests (24h) and admins (8h)

This control requires Azure AD Premium P1 (included in Microsoft 365 E3) or higher.

CA-11 is included in the TrueConfig Recommended Secure baseline (Level 1). This is the foundation level suitable for most organizations.