NSP.M365.ConditionalAccess

0.1.0

Policies/NSP-ADMIN-SESSION-01.psd1

                                @{

    Id = 'NSP-ADMIN-SESSION-01'

    Name = 'Administrators sign in again every 12 hours, without persistent browser sessions'

    Version = 1

    Description = 'Holders of privileged directory roles sign in again every 12 hours, and their browser sessions do not persist after the browser closes.'

    Notes = 'New with the module (2026-10-09), from the common baselines (4 to 12 hours there).'

    DefaultState = 'reportOnly'

    Users = @{

        IncludeRoles = @(

            '{Role:ApplicationAdministrator}'

            '{Role:AuthenticationAdministrator}'

            '{Role:AuthenticationPolicyAdministrator}'

            '{Role:BillingAdministrator}'

            '{Role:CloudApplicationAdministrator}'

            '{Role:ConditionalAccessAdministrator}'

            '{Role:ExchangeAdministrator}'

            '{Role:HelpdeskAdministrator}'

            '{Role:PasswordAdministrator}'

            '{Role:PrivilegedAuthenticationAdministrator}'

            '{Role:PrivilegedRoleAdministrator}'

            '{Role:SecurityAdministrator}'

            '{Role:SharePointAdministrator}'

            '{Role:TeamsAdministrator}'

            '{Role:UserAdministrator}'

            '{Role:GlobalAdministrator}'

        )

        ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}')

    }

    Applications = @{

        Include = @('All')

    }

    Session = @{

        SignInFrequency = @{ Value = 12; Type = 'hours' }

        PersistentBrowser = 'never'

    }

}