Share via

Azure CA / MFA and periodic reauthentication, what's the criteria?

Nils Norell 20 Reputation points
2023-04-18T10:41:15.5666667+00:00

Hello, Since setting up conditional access with session controls of a sign in frequency / periodic reauthentication of 7 days with persistent browser sessions, there are a few things that I find difficult to understand how they work. Once you've approved an MFA challenge, what determines whether you're going to get another one within 7 days or not? Are you whitelisted if you're accessing a service from the same external ip? or with the same account? or with the same device? All within the space of those 7 days I mean. For instance, I logged in to OWA, and then I'm not getting an MFA challenge for the cisco anyconnect VPN client that is also AAD integrated with an enterprise application, so what exactly is producing this result? Thanks so much, hoping to get some understanding on the subject! //Nils

Microsoft Security | Microsoft Entra | Microsoft Entra ID
Accepted answer
  1. Akshay-MSFT 17,956 Reputation points Microsoft Employee Moderator
    2023-04-20T09:29:26.6633333+00:00

    @Nils Norell

    Thank you for posting your query on Microsoft Q&A.

    From the above description I understand that you are looking how does Azure AD CA policy identify whether reauthentication is needed after defined period or not. Please do correct me if you have any discrepancy.

    This policy does evaluate the condition based on "refresh token" lifetime.

    For example if you have set periodic reauthentication of 7 days with persistent browser sessions, then every time user tries access any of the cloud applications (part of CA policy), the access token will be granted only after validating the life time of refresh token user session is holding.

    1. If the refresh token was issued within last 7 days, then user will get access token to access the application, however if refresh token was issued more than 7 days ago, then user will be prompted for reauthentication.
    2. The lifetime of refresh token is calculated from date of issuance by Azure AD.

    Please do let me know if you have any further queries in the comments section.

    Thanks,

    Akshay Kaushik

    Please "Accept the answer" (Yes), and share your feedback if the suggestion works as per your business need. This will help us and others in the community as well.

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.