The F5 BIG-IP appliance providing user access control intermediary services must limit the "Max Sessions Per User" to one or an organization-defined number for each access profile.

The "Max Sessions Per User" setting is crucial for maintaining session limits per individual user, preventing issues such as VDI applications disconnecting multiple users and becoming unusable for concurrent access. The default value for "Max Sessions Per User" is "0" (unlimited), so this setting must be set to implement a limit.

If the BIG-IP appliance does not provide user access control intermediary services, this is not applicable.

From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click the Name of the Access profile. 5. Under "Settings", verify "Max Sessions per User" is set to "1" or to an organization-defined number.

If the BIG-IP appliance is not configured to limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number, this is a finding.

From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click the Name of the Access profile. 5. Under "Settings", set "Max Sessions per User" to "1" or to an organization-defined number. 6. Update.