We have been using Azure for almost 5 years, and we are very concerned about security.
One thing I really do not understand is why there is no session timeout in the Azure Portal (e.g. automatically sign out after 30 minutes of inactivity). As you hopefully all know, if you have access to the portal you can delete everything with a click of a button.
I always start the Portal in Chrome Incognito mode, and sign in with two-step authentication. Sometimes I forget to close the browser, and when I resume my laptop after a few days I just have to hit F5, and then I have access to everything. Even worse... if you just navigates away from the portal and revisits it after a few days you are still signed in.
Is it possible to configure session timeout, to ensure a session does not live forever?