Microsoft Entra IDOverview
If you use Conditional Access, you can disable/exempt this control
Remembering Multi-Factor Authentication (MFA) for devices and browsers allows users to bypass MFA for a set number of days after a successful sign-in using MFA. This can enhance usability by minimizing the times a user may need to perform two-step verification on the same device. However, remembering MFA for trusted devices may affect security if an account or device is compromised. Hence, it is recommended that users not be allowed to bypass MFA.
There are two main issues with this setting:
- It bypasses conditional access policies.
- The device remains trusted even if the user logs out.
You can read more about this setting in the Microsoft Docs.
Default Value
By default, Allow users to remember multi-factor authentication on devices they trust is disabled.
Manual Audit
Since there is no API to check this, it is recommended to audit the setting manually:
- Open the
Service Settingspage at https://account.activedirectory.windowsazure.com/UserManagement/MfaSettings.aspx. You might have to append the tenant ID to the URL:?tenantId=yourtenantID - Ensure that
Allow users to remember multi-factor authentication on devices they trustis not enabled
Remediation guidance
- Open the
Service Settingspage at https://account.activedirectory.windowsazure.com/UserManagement/MfaSettings.aspx. You might have to append the tenant ID to the URL:?tenantId=yourtenantID - Uncheck
Allow users to remember multi-factor authentication on devices they trust.
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Microsoft Entra ID
Use tenant-wide Conditional Access, role settings, authentication policies, and identity governance baselines so the control is enforced centrally.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
All Entra tenants
Connectors
Covered asset types
Expected check: eq []
{
connectors(where: {cloudProvider: "entra"}) {
...AssetFragment
}
}
