How to Fix: Configure Session Controls
Step-by-step guide to implement configure session controls in your Microsoft 365 environment.
5-10 minutes
Estimated Time
4
Steps
medium
Severity
Enhanced Security
Baseline Level
Why This Matters
Long-lived sessions increase the window for session hijacking and token theft. Enforcing sign-in frequency limits how long a stolen session token remains valid.
Prerequisites
- 1Global Administrator or appropriate admin role in Microsoft Entra ID
- 2Access to Microsoft Entra admin center (entra.microsoft.com)
- 3Microsoft Entra ID P1 or higher license
- 4Conditional Access Administrator role (minimum)
Expected Configuration
- Sign-in frequency is enforced for admin sessions (8 hours)
- Sign-in frequency is enforced for user sessions (24 hours)
- Persistent browser sessions are controlled for sensitive scenarios
Remediation Steps
Review Existing Policies
Examine your current Conditional Access policies.
- •Navigate to Microsoft Entra admin center
- •Go to Protection > Conditional Access
- •Review existing policies and their configurations
Design Policy Configuration
Plan the Conditional Access policy that addresses this control.
- •Define target users and groups
- •Determine target applications
- •Plan grant and session controls
Create or Update Policy
Implement the Conditional Access policy.
- •Create new policy or modify existing one
- •Configure assignments (users, apps, conditions)
- •Set appropriate grant and session controls
- •Start in Report-only mode for testing
Test and Enable
Validate the policy works correctly before full enforcement.
- •Monitor Report-only results
- •Test with pilot group
- •Switch to On when confident
- •Run TrueConfig scan to verify compliance
Auto-Remediation Available
TrueConfig can automatically fix this control for you. Enable auto-remediation to have this configuration applied and maintained automatically.
Learn about auto-remediationRelated Resources
Automate Your Security Configuration
TrueConfig continuously monitors your Microsoft 365 environment and can automatically fix configuration drift. Start your free trial today.
Start Free Trial