1

We have been using Azure for almost 5 years, and we are very concerned about security.

One thing I really do not understand is why there is no session timeout in the Azure Portal (e.g. automatically sign out after 30 minutes of inactivity). As you hopefully all know, if you have access to the portal you can delete everything with a click of a button.

I always start the Portal in Chrome Incognito mode, and sign in with two-step authentication. Sometimes I forget to close the browser, and when I resume my laptop after a few days I just have to hit F5, and then I have access to everything. Even worse... if you just navigates away from the portal and revisits it after a few days you are still signed in.

Is it possible to configure session timeout, to ensure a session does not live forever?

11
  • 4
    Ask Microsoft? I don't see how anyone here could answer that.
    – faker
    Apr 23, 2015 at 8:55
  • 2
    I'm voting to close this question as off-topic because it's not about programming. Only Microsoft can answer this question.
    – Mischa
    Apr 23, 2015 at 13:14
  • 2
    On that Microsoft page it just says SO is a great place to ask. Doesn't say anything about "official forum" or that they will answer the questions. Anyway this question is off topic here as well.
    – Mischa
    Apr 23, 2015 at 13:16
  • 1
    This would be very annoying if implemented. It takes me about an hour to carefully roll out an update to our service. I'd rather not reenter the credentials more than once in my workday.
    – sharptooth
    Apr 23, 2015 at 13:33
  • 1
    Stack Overflow and Server Fault are meant to be very different sites. I'm not sure how your question ended up here either. Apr 23, 2015 at 18:23

3 Answers 3

3

This option is now available in the Azure portal for Tenant/directory administrators. Click the portal settings (gear) icon and then click the 'Configure directory level timeout'. Enable the feature, set a time span (hours and minutes) and click Apply. Once configured, the changes will take effect after a logout/login and all users of the tenant will see a message in the portal settings pane.

1
  • Sure enough it was there! Seemed too easy. Nice, thanks! Feb 3, 2020 at 13:33
1

I am not sure if at the time you did it this feature was not available, but there is a way to do an "inactivity logout".

screenshot of the feature

0

Start out by asking what's the attack vector?

If it's that someone can come along and resume your session, they can do a lot more damage. If an attacker can get access to your computer unlocked, they can do SO MUCH WORSE. For example, they could install a modified browser that keylogs everything and sends it to them. Or even worse they can execute a Man In The Browser Attack. Session expiry is going to do extremely little since they will just gain access next time you login.

The same attacks happen if you're using a shared computer.

In the vast majority of cases short timeouts only help against extremely primitive attackers. In general, the user experience pain the provide far outweighs any possible security benefit.

Which is why most non-bank systems have gone away from short session timeouts...

2
  • 1
    What can be worse than deleting the data, which our entire business is built upon? I never leave my computer unattended. However, I once forgot to lock my computer when picking up coffee. What I'm addressing here, is that by default I don't think it's a good practice to have sessions running for days, even if you navigate away from the site! Somebody could have browsed to portal.azure.com and within 1-2 minutes destroyed all data stores, backup and services - the entire foundation for our business. Is there really no way to raise the security? Apr 23, 2015 at 18:07
  • @ThomasJespersen the way you solve that is how github does: require a privilege escalation to do anything significantly damaging. Which likely requires a 2fa
    – ircmaxell
    Apr 23, 2015 at 18:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.