# Cis Azure Foundations 5.9

> Ensure 'Number of days before users are asked to re-confirm their authentication information' is not set to '0'

- Skill: `cyberstrikeus/cis-azure-foundations-5-9` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-azure-foundations-5-9`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-azure-foundations-5-9/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-azure-foundations-5-9

---


# Ensure 'Number of days before users are asked to re-confirm their authentication information' is not set to '0'

## Description

Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0.

## Rationale

This setting is necessary if 'Require users to register when signing in' is enabled. If authentication re-confirmation is disabled, registered users will never be prompted to re-confirm their existing authentication information. If the authentication information for a user changes, such as a phone number or email, then the password reset information for that user reverts to the previously registered authentication information.

## Impact

Users will be prompted to re-confirm their authentication information after the number of days specified.

## Audit Procedure

### Using Azure Portal

1. From Azure Home select the Portal Menu.
2. Select `Microsoft Entra ID`.
3. Under `Manage`, select `Users`.
4. Select `Password reset`.
5. Under `Manage`, select `Registration`.
6. Ensure that `Number of days before users are asked to re-confirm their authentication information` is not set to `0`.

## Expected Result

`Number of days before users are asked to re-confirm their authentication information` should not be `0`. A value such as 180 days is recommended.

## Remediation

### Using Azure Portal

1. From Azure Home select the Portal Menu.
2. Select `Microsoft Entra ID`.
3. Under `Manage`, select `Users`.
4. Select `Password reset`.
5. Under `Manage`, select `Registration`.
6. Set the `Number of days before users are asked to re-confirm their authentication information` to your organization-defined frequency.
7. Click `Save`.

## Default Value

By default, the `Number of days before users are asked to re-confirm their authentication information` is set to "180 days".

## References

1. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks#registration
2. https://support.microsoft.com/en-us/account-billing/reset-your-work-or-school-password-using-security-info-23dde81f-08bb-4776-ba72-e6b72b9dda9e
3. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-6-define-and-implement-identity-and-privileged-access-strategy
4. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods

## CIS Controls

| Controls Version | Control                                           | IG 1 | IG 2 | IG 3 |
| ---------------- | ------------------------------------------------- | ---- | ---- | ---- |
| v8               | 6.2 Establish an Access Revoking Process          | x    | x    | x    |
| v7               | 16.10 Ensure All Accounts Have An Expiration Date |      | x    | x    |

## Profile

Level 1 | Manual