# 1.4 Ensure that 'Allow users to remember multi-factor authentication on devices they trust' is 'Disabled

- Source: https://support.icompaas.com/support/solutions/articles/62000219682-1-4-ensure-that-allow-users-to-remember-multi-factor-authentication-on-devices-they-trust-is-disab
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [1. Identity and Access Management](https://support.icompaas.com/support/solutions/folders/62000167544)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

Do not allow users to remember multi-factor authentication on devices. When you restore MFA authentication on all remembered devices for a user, the user will be challenged to perform two-step verification the next time they sign in, regardless of whether or not they chose to mark their device as trusted.

  

## **Rationale:**

Remembering Multi-Factor Authentication(MFA) for devices and browsers allows users to have the option to bypass MFA for a set number of days after performing a successful sign- in using MFA. This can enhance usability by minimizing the number of times a user may need to perform two-step verification on the same device. 

  

## **Impact:**

For every login attempt, the user will be required to perform multi-factor authentication.

  

## **Default Value:**

By default, "Allow users to remember multi-factor authentication on devices they trust" is disabled.

  

## **Audit:**

1.  Go to Azure Active Directory
    
2.  Go to Users
    
3.  Go to All Users
    
4.  Click on **Per-user MFA(Multi-Factor Authentication)** button on the top bar
    
      
    
5.  Click on service settings
    
6.  Check that **Allow users to remember multi-factor authentication on devices they trust** is not enabled
    

## **Remediation:**

### Pre-Requisite:

1.  A working Azure AD tenant with at least an Azure AD Premium P1 or trial license enabled.
    
2.  An account with _global administrator_ privileges.
    

  

### Implementation:

1.  Go to Azure Active Directory  
    ![](https://support.icompaas.com/assets/kb/901fca5431704164.png)
    
2.  Go to Users  
    ![](https://support.icompaas.com/assets/kb/c1b35ca7d3cb4a7e.png)
    
3.  Go to All Users  
    ![](https://support.icompaas.com/assets/kb/aae3359906c8da5a.png)
    
4.  Click on **Per-user MFA(Multi-Factor Authentication)** button on the top bar
    
      
    
5.  Click on service settings  
      
    ![](https://support.icompaas.com/assets/kb/a9ca6931e9b25361.png)
    
6.  Disable Allow users to remember multi-factor authentication on devices they trust  
    ![](https://support.icompaas.com/assets/kb/4163a6bd27cb95dc.png)
    

  

  

## **Backout Plan:**

1.  Go to Azure Active Directory
    
2.  Go to Users
    
3.  Go to All Users
    
4.  Click on Per-user MFA button on the top bar
5.  Click on service settings
    
6.  Enable “Allow users to remember multi-factor authentication on devices they trust”  
    

## **  
Note:**

Please note that at this point in time, there is no API/CLI mechanism available to programmatically conduct a security assessment for this recommendation.

  

## ****References:****

1.  ****[](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-whats-next#remember-multi-factor-authentication-for-devices-that-users-trust "https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-whats-next#remember-multi-factor-authentication-for-devices-that-users-trust")**[](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-whats-next#remember-multi-factor-authentication-for-devices-that-users-trust "https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-whats-next#remember-multi-factor-authentication-for-devices-that-users-trust")**[](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-whats-next#remember-multi-factor-authentication-for-devices-that-users-trust "https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-whats-next#remember-multi-factor-authentication-for-devices-that-users-trust")[](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-whats-next#remember-multi-factor-authentication-for-devices-that-users-trust "https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-whats-next#remember-multi-factor-authentication-for-devices-that-users-trust")[https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor- authentication-whats-next#remember-multi-factor-authentication-for-devices-that- users-trust](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-whats-next#remember-multi-factor-authentication-for-devices-that-users-trust "https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-whats-next#remember-multi-factor-authentication-for-devices-that-users-trust")
    
2.  [https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls- v2-identity-management#im-4-use-strong-authentication-controls-for-all-azure- active-directory-based-access](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-identity-management#im-4-use-strong-authentication-controls-for-all-azure-active-directory-based-access "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-identity-management#im-4-use-strong-authentication-controls-for-all-azure-active-directory-based-access")[](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-identity-management#im-4-use-strong-authentication-controls-for-all-azure-active-directory-based-access "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-identity-management#im-4-use-strong-authentication-controls-for-all-azure-active-directory-based-access")[](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-identity-management#im-4-use-strong-authentication-controls-for-all-azure-active-directory-based-access "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-identity-management#im-4-use-strong-authentication-controls-for-all-azure-active-directory-based-access")**[](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-identity-management#im-4-use-strong-authentication-controls-for-all-azure-active-directory-based-access "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-identity-management#im-4-use-strong-authentication-controls-for-all-azure-active-directory-based-access")**[](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-identity-management#im-4-use-strong-authentication-controls-for-all-azure-active-directory-based-access "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-identity-management#im-4-use-strong-authentication-controls-for-all-azure-active-directory-based-access")****

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.