1

Our company has rolled out MFA to our users. We are a Microsoft shop, so we are using Azure AD to handle MFA and authentication to things like email, Teams, Sharepoint, etc. By default, we've disabled MFA prompts when users are on our company network. But of course, since almost everyone is working remotely right now, this policy is never in effect.

The biggest pushback we are seeing is that we have set the token expiration to 24 hours. So our users must sign back into Teams, Office and Outlook on their own phones and computers every 24 hours. This is understandably frustrating for our users.

We noticed that he default sign-in expiration when setting up Azure AD is 90 days. This seems a bit long to us. But are we at a heightened risk if we set the expiration to a week? Or two? I've looked everywhere, and can't see anything related to best practices around this. If anyone has links to trusted publications that can outline best practices for how often to prompt for credentials, it would be really appreciated!

3
  • "This seems a bit long to us." -- why? The answer to that will inform everything else.
    – schroeder
    Jun 14, 2020 at 15:21
  • I guess we're thinking about the different scenarios. So let's say someone's credentials are stolen / guess, and someone is able to bypass MFA through social engineering or some other method and logs in to someone's email account. If it wasn't caught, that's 90 days where they won't be challenged again and would have unrestricted use of someone's email account.
    – catfactory
    Jun 14, 2020 at 15:25
  • 1
    Ah, but if the social engineering happens on day 1, then the malicious actor has a week (or two). You might need to re-think what the timeout is for.
    – schroeder
    Jun 14, 2020 at 15:33

2 Answers 2

1

@schroeder brought up the best answer possible. Usually you should assess these accounts/connections/services/devices (aka assets) properly.

Low hanging fruit:

  • HAADJ or compliant Intune-enrolled --> No MFA prompt for normal user and O365-Services
  • High-privileged-accounts/access --> at least 1 MFA/day and only possible from HAADJ or compliant Intune
  • Unmanaged device --> No Sign-In at all. If this is not possible: 1 MFA/Sign-In (No persistent browser session allowed)

Surely you can fine-tune the sign-ins with UserRisk/SignIn-Risk/MCAS-Session-Policy.

But honestly: I have never experienced a company before, where user are frustrated by using FaceID/Fingerprint for about 3s once a day...

0

There is no "best practice" for this. This requires a risk assessment.

Risk assessments look at the impact of having one setting or another in context, with a defined threat model.

You have several contexts to consider:

  • admin users and senior management have greater risks with their accounts
  • how exposed is your corporate network to unauthorised people?
  • are the devices controlled, secured, and monitored?
  • how trustworthy are your employees?
  • what other mitigations do you have in place if an account is compromised?
  • what are you using the timeout for?

For many, a timeout of 90 days is just fine for:

  • low priv users
  • in a secured building
  • with company devices
  • with strong security hygiene
  • account monitoring, deactivation procedures, absence monitoring
  • where the timeout is to prevent old, unused, or infrequently accounts from being misused by malicious actors with local access

Specific Example:

In my contexts, once an account is compromised, the most common case, by far, it is immediately used to spam other company accounts to send a phishing link. Once a juicy account is found, it is immediately used to dig deeper into the network or launch ransomware. An MFA account timeout doesn't help against this threat. Compromised accounts have their credentials reset.

Heightened Risks

Are you at a heightened risk to extend the timeout from 1 day to 2 weeks? Of course. But that's not the question. Are the risks of extending the timeout to 2 weeks acceptable? There is no standard or "best practice" for that question. That's what a risk assessment is for.

1
  • Building on what @schroeder has to say, accounting for employee time and frustration is also important. Is the short reset window impeding critical work, it doesn't seem like it would, but are you employee's frustrated enough that they can't focus on tasks, or feel the need to submit excess complaints and help desk tickets? If so, then the security control itself becomes an issue impeding efficient business operations and it may justify accepting more risk to protect core operations, which highlights the need to re-evaluate and re-assess risk periodically.
    – jfran3
    Oct 10, 2020 at 5:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .