Microsoft Entra IDOverview
If you use Conditional Access, you can disable/exempt this control
Remembering Multi-Factor Authentication (MFA) for devices and browsers allows users to bypass MFA for a set number of days after a successful sign-in using MFA. This can enhance usability by minimizing the times a user may need to perform two-step verification on the same device. However, remembering MFA for trusted devices may affect security if an account or device is compromised. Hence, it is recommended that users not be allowed to bypass MFA.
There are two main issues with this setting:
- It bypasses conditional access policies.
- The device remains trusted even if the user logs out.
You can read more about this setting in the Microsoft Docs.
Default Value
By default, Allow users to remember multi-factor authentication on devices they trust is disabled.
Manual Audit
Since there is no API to check this, it is recommended to audit the setting manually:
- Open the
Service Settingspage at https://account.activedirectory.windowsazure.com/UserManagement/MfaSettings.aspx. You might have to append the tenant ID to the URL:?tenantId=yourtenantID - Ensure that
Allow users to remember multi-factor authentication on devices they trustis not enabled
Remediation guidance
- Open the
Service Settingspage at https://account.activedirectory.windowsazure.com/UserManagement/MfaSettings.aspx. You might have to append the tenant ID to the URL:?tenantId=yourtenantID - Uncheck
Allow users to remember multi-factor authentication on devices they trust.
Multiple Remediation Paths
SERVICE-WIDE (RECOMMENDED when many resources are affected): Apply organization/tenant-level guardrails and baseline policies for the entire platform.
ASSET-LEVEL: Fix only the affected resources identified by this control.
PREVENTIVE: Add preventive policy checks to CI/CD and periodic posture scans.
References for Service-Wide Patterns
- Platform policy/governance and preventive control patterns should be applied tenant-wide where supported.
Query logic
These are the stored checks tied to this control.
All Entra tenants
Connectors
Covered asset types
Expected check: eq []
{
connectors(where: {cloudProvider: "entra"}) {
...AssetFragment
}
}
