how long will users remain logged in for SSO even with persistent storage

Question

When a user selects "Stay signed in" for persistent storage in MSAL, how long will they remain logged in after closing the browser before being forced to re-authenticate by default?

Answer 1

Hello Ahmad Mujeeb

Thank you for reaching out to Microsoft Q&A.

when you call MSAL with the “Stay signed in” (KMSI) option, MSAL drops a persistent refresh token (and cookie) in the browser. That token lives for a rolling 90-day window by default—so users can close and reopen their browser any number of times within that 90-day period and still get silently re-authenticated. Once the refresh token hits its 90-day lifetime (or if the user resets their password, you revoke sessions via Graph/portal, or you have a Conditional Access sign-in-frequency/persistent-browser-session policy in place), they’ll be prompted to sign in again.

Key points:

1. MSAL cache vs. Entra session
   • MSAL’s persistent cache (for example, localStorage) only controls whether tokens and account state survive browser close/reopen.
     • Actual sign-in validity is governed by Microsoft Entra ID session cookies and token lifetimes.
2. Default behavior without custom policies

• If no special session lifetime settings are configured, the browser session has no persistent cookies, and closing the browser requires reauthentication on next use.
• When “Stay signed in?” is used and allowed, it sets a persistent cookie so the user can remain signed in across browser restarts until:

  - The session or refresh token expires, or
  
        - The session is revoked (password reset, admin action, Conditional Access, etc.).
  

  • For Office/modern auth clients, refresh tokens are valid for up to 90 days and can remain valid with continuous use until revoked.

Below are the reference list:-

1. Configure, disable, or troubleshoot the “Stay signed in?” prompt (KMSI) https://docs.microsoft.com/azure/active-directory/fundamentals/keep-me-signed-in
2. Reauthentication prompts and session lifetime for Microsoft Entra MFA https://learn.microsoft.com/entra/identity/authentication/concepts-azure-multi-factor-authentication-prompts-session-lifetime
3. Conditional Access session controls (sign-in frequency & persistent browser session) https://docs.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime

If the resolution was helpful, do click Accept Answer and Yes and upvote it 👍 for was this answer helpful, which may help members with similar questions.

Thank you for helping to improve Microsoft Q&A!