Forum Discussion

JakobRohde's avatar
JakobRohde
Iron Contributor
Jan 02, 2023

How to disable option to stay signed in

The option for users to choose to stay signed in to Office 365 is a potential security problem. We have MFA turned on, but if users stay signed in another person may access the tenant if the computer is left unattended or is hacked.

 

It was possible to turn this option off in Company Branding in AAD until the latest (preview) version of Company Branding was released. For some reason that feature is not available in the latest version. I assume I can revert to the previous version, and then turn it off, but when doing that, I receive a warning that it may have negative consequences for SharePoint Online, but it doesn't say what those consequences are. So, my questions are: 

 

1. Can I turn it off by reverting to the previous version of Company Branding and what are the consequences?

2. Is it possible to achieve the same result in another way? PowerShell or Conditional Access maybe?

  • JakobRohde 

    I thought it was still exist: 

     

    Log in to https://admin.microsoft.com as a Global Administrator.
    Go to Admin centers and click on Azure Active Directory, once in the AD Admin Center select Azure Active Directory.
    Scroll down and select Company branding under Manage followed by the appropriate policy.
    If no policy exists you will need to create one.
    Scroll to the bottom of the newly opened pane and ensure Show option to remain signed in is set to No.
    Click Save.
    Default Value:
    Users may select stay signed in

    • JakobRohde's avatar
      JakobRohde
      Iron Contributor
      Hi Kidd_Ip

      I don't see that in my tenant. I assume you are referring to the previous version.
      • TuomasO's avatar
        TuomasO
        Copper Contributor
        I had the same problem, and as I couldn't find the answer by googling, I dove into the settings to find it. Here's the answer for posterity:

        The setting has been moved from Company branding -blade to User settings -blade, "Show keep user signed in".

Resources