# 1.6 Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to "0" - Source: https://support.icompaas.com/support/solutions/articles/62000219684-1-6-ensure-that-number-of-days-before-users-are-asked-to-re-confirm-their-authentication-information - Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [1. Identity and Access Management](https://support.icompaas.com/support/solutions/folders/62000167544) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## **Description:** Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0. ## **Rationale:** If authentication re-confirmation is disabled, registered users will never be prompted to re-confirm their existing authentication information. If the authentication information for a user, such as a phone number or email changes, then the password reset information for that user reverts to the previously registered authentication information. ## **Impact:** The "Number of days before users are asked to re-confirm their authentication information" represents the period of time, up to a maximum of 730 days, before AD registered users are prompted to reconfirm their existing authentication details to make sure that these are still valid. If authentication reconfirmation is disabled, i.e. set to zero days, the Active Directory users will never be prompted to reconfirm their existing authentication information. ## **Default Value:** By default, the 'Number of days before users are asked to re-confirm their authentication information is set to '180 days'. ## **Audit:** 1. Go to Azure Active Directory 2. Go to Users 3. Go to Password reset 4. Go to Registration 5. Ensure that Number of days before users are asked to re-confirm their authentication information is not set to 0 ## **Remediation:** ### Pre-Requisite: 1. A working Azure AD tenant with at least an Azure AD Premium P1 or trial license enabled. 2. An account with _global administrator_ privileges. ### Implementation Steps: 1. Go to Azure Active Directory ![](https://support.icompaas.com/assets/kb/441aab8a6a792be4.png) 2. Go to Users ![](https://support.icompaas.com/assets/kb/b1aadf208f912109.png) 3. Go to Password reset ![](https://support.icompaas.com/assets/kb/c4878e86f89132bc.png) 4. Go to Registration ![](https://support.icompaas.com/assets/kb/e816cdb7124706a1.png) 5. Set the **Number of days before users are asked to re-confirm their authentication information** to your organization-defined frequency(range is 0 to 730) ![](https://support.icompaas.com/assets/kb/c1463e237460a414.png) ### Backout Plan: 1. Go to Azure Active Directory 2. Go to Users 3. Go to Password reset 4. Go to Registration 5. Ensure the Number of days before users are asked to re-confirm their authentication information is set to 0 ## **Note:** Please note that at this point of time, there is no API/CLI mechanism available to programmatically conduct security assessment for this recommendation. ## **References:** 1. **[](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-how-it-works#registration "https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-how-it-works#registration")**[](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-how-it-works#registration "https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-how-it-works#registration")[https://docs.microsoft.com/en-us/azure/active-directory/active-directory- passwords-how-it-works#registration](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-how-it-works#registration "https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-how-it-works#registration") 2. [https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto- sspr-deployment](https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment "https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment") 3. [https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls- v2-governance-strategy#gs-6-define-identity-and-privileged-access-strategy](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-6-define-identity-and-privileged-access-strategy "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-6-define-identity-and-privileged-access-strategy")[](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-6-define-identity-and-privileged-access-strategy "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-6-define-identity-and-privileged-access-strategy")**[](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-6-define-identity-and-privileged-access-strategy "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-6-define-identity-and-privileged-access-strategy")** ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.