We are considering replacing our on-premise SharePoint intranet with SharePoint Online. I won't spell out the advantages, but I can see one big disadvantage - the "Keep me signed in"-button...
Our company has a number of consultants who spend most of their days working from our customers' sites. When they do this, the consultants are normally using the customers' PC:s on the customers' network and domain.
From there, our consultants need to access our intranet. Today, to access our intranet from outside our corp network, the user has to use VPN (I know, a little old fashioned). This is configured such that the user cannot save the password they use to logon to our corp network)
But, with SharePoint Online, all they would have to do is to point their browser to ourcompanyname.sharepoint.com and login using their Office 365 credentials. And, at that point, they can check the "Keep me signed in"-button. (Yes, I know that we should encourage our employees not to do this, but it is unrealistic to believe that eveveryone should obey this).
If a consultant checks the "Keep me logged in" box, a domain admin could reset the password of the consultant and login with the new password. Then, simply open the IE and access the consultant's email and our corporate information on SharePoint Online.
And there doesn't seem to be any way to control the behaviour of this, no way to turn off the "Keep me signed in"-button. All we can do is to turn on Multi-factor authentication, but that won't take away the problem - as soon as the user checks the "Keep me signed in", no authentication will take place, multi-factor or not.
I am surprised that I don't see more discussions about this. Previously, there have been lots of ways to protect our intranets (VPN, RSA-things, ISA-servers etc) but all we can do now is to start every morning meeting with a "Don't forget to not check the checkbox!".
Or am I missing something?
Thanks, Fredrik
