Conditional Access Policy not working configured for session control

Question

Conditional Access Policy not working configured for session control

Aditya Pande 0

Hi Team,

We have configured conditional access policy in Entra ID tenant which is applicable on all Entra ID users excluding admin account. Target resources being setup as all cloud apps with on exclusion.

In Conditions, we have selected Sign-in risk as High. In Grant, we have grant access to require MFA.

In Session Control, first we selected sign-in frequency as everytime but it was not working. Then, we setup periodic reauthentication for 1 hr duration and select persistent browser session as never persistent.

But still, this policy is not working on Entra ID users. I am attaching screenshots of policy configuration done. Also, it is set as Enabled.cap_grant_option.png

CAP_Session_Control.png

Aditya Pande 0 Reputation points

2026-05-22T15:31:35.61+00:00

Hi Rukmini,

Thanks for your quick response. After removing Sign-In Risk condition, policy was working on selected users. We selected Sign-in-risk =high as there is microsoft managed policy in a different tenant which is also doing this same thing and enforced on group of Entra ID users in that this condition was set and policy was working.You can see below microsoft managed policy configured in another tenant attached with screenshot. If this policy is not responsible for frequent reauthentication, then can you confirm what might be causing this behaviour in different tenant.

mmp_cap.png
Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-05-22T15:40:33.8066667+00:00
Hello Aditya Pande

The Microsoft-managed policy shown in the other tenant is an Identity Protection-based Conditional Access policy. In those scenarios, frequent MFA prompts or reauthentication can occur because continuously reevaluates the user’s sign-in risk during token refresh and session activity.

Tenant behavior may vary despite the policy condition being set to Sign-in risk = High because of:

Various risk assessments for identity protection

Frequency of token risk reevaluation

History of user risk

Token lifespan behavior and authentication context

Additional covert Microsoft-managed safeguards or security defaults

The policy may repeatedly initiate MFA and session reevaluation, which could manifest as periodic reauthentication, if the tenant regularly identifies dangerous sign-ins.

The session controls are not implemented in your current tenant since the Conditional Access policy is not activated because the sign-in events are not categorized as High risk.

You can validate this by reviewing: Entra ID → Sign-in Logs → Risk detail / Risk level / Conditional Access

This will confirm whether the affected sign-ins are actually being evaluated as High risk in both tenants.
Aditya Pande 0 Reputation points

2026-05-22T18:41:23.62+00:00

Hi Rukmini,

Thanks for clarifying this. I have investigated some of risk policies such as user risk and sign-in risk policies and compared current tenant with other tenant.

Sign-in risk policy in other tenant has control configured to require multifactor authentication and sign-in risk set as medium and above. I have attached screenshot for this.

idp_policy.png

Is this possible for prompting user for periodic reauthentication as Microsoft Managed CAP is not being applied to users as checked in sign-in logs.

If so, then can we recreate risk sign-in kind of scenario in our current tenant?
Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-05-25T09:09:12.38+00:00
Hello Aditya Pande

Yes, this is feasible. Identity Protection Sign-in Risk rules configured with "Medium and above" + "Require MFA" may nevertheless cause recurring MFA prompts or periodic reauthentication behavior even if the Microsoft-managed Conditional Access policy is not displayed as implemented in Sign-in Logs.

This happens as a result of Identity Protection's ongoing assessment of token risk and sign-in throughout session activity and token refresh processes. Users may be asked to authenticate again if dangerous signals are consistently identified.

Yes, you can recreate similar behavior in your current tenant for testing purposes by:

Setting up a policy for sign-in risk using: Sign-in risk = Medium and above; grant = Require MFA

Completing sign-ins from: Distinct geographical locations/IPs, Anonymous/Tor networks. New devices or web browsers Unknown patterns of sign-in

After testing, review: Entra ID → Sign-in Logs → Risk level / Risk detections / Conditional Access

Please be aware that Microsoft Identity Protection dynamically generates risk detections, which may differ amongst tenants based on backend risk assessment, previous signals, and user behavior.
Aditya Pande 0 Reputation points

2026-05-25T14:06:16.08+00:00

Hi Rukmini,

I am trying to edit sign-in risk policy and change it to suggested settings but it is not allowing me saying below in info button ->

This risk policy is now read-only and will be retired on October 1, 2026. To manage or modify it, migrate it to Conditional Access.

But in other tenant it is showing same in info button but policy is enabled and also updated with those settings.
Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-05-25T14:10:33.6333333+00:00

Hello Aditya Pande

The behavior difference is expected. Microsoft has started retiring legacy Identity Protection risk policies and migrating customers toward Conditional Access-based risk policies.

Since your current tenant's Sign-in Risk policy has already entered the read-only retirement phase, changes are prohibited, and the message appears:

Even though the identical informational banner is displayed, the current settings are still accessible and active in the other tenant because the policy was probably configured or altered before the retirement enforcement reached that tenant.
Aditya Pande 0 Reputation points

2026-05-25T14:41:51.8466667+00:00

Hi Rukmini,

Ok. So, do I need to migrate those to Conditional Access-based risk policy? Can you share detailed documentation for doing this process.

Thanks.
Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-05-26T10:22:53.65+00:00

Aditya Pande we will check internally and get back to you!
Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-05-28T11:19:02.51+00:00
Hello @Aditya Pande

Yes, as traditional Identity Protection risk policies are being retired and made read-only, switching to Conditional Access-based risk policies is the advised and endorsed course of action moving ahead.

If you do not migrate: Microsoft will stop supporting those legacy risk rules after October 1, 2026. If the policy is already established, it may continue to function temporarily, but new changes will eventually be prohibited.

To recreate the same functionality in Conditional Access:

Create a new Conditional Access policy

Users → select target users/groups

Cloud apps → All cloud apps

Conditions → Sign-in risk → Medium and above

Grant → Require multifactor authentication

Session → configure Sign-in frequency / Persistent browser session as needed

Enable policy in Report-only mode first, then switch to On after validation

Reference: https://learn.microsoft.com/en-in/entra/id-protection/howto-identity-protection-configure-risk-policies?
Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-05-29T09:46:05.7033333+00:00

Hello @Aditya Pande

Following up to see if the above provided information was helpful. If you have any further queries do let us know.

2 answers

Your answer

Aditya Pande 0 Reputation points

2026-05-22T15:31:35.61+00:00

Hi Rukmini,

Thanks for your quick response. After removing Sign-In Risk condition, policy was working on selected users. We selected Sign-in-risk =high as there is microsoft managed policy in a different tenant which is also doing this same thing and enforced on group of Entra ID users in that this condition was set and policy was working.You can see below microsoft managed policy configured in another tenant attached with screenshot. If this policy is not responsible for frequent reauthentication, then can you confirm what might be causing this behaviour in different tenant.

mmp_cap.png
Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-05-22T15:40:33.8066667+00:00

Hello Aditya Pande

The Microsoft-managed policy shown in the other tenant is an Identity Protection-based Conditional Access policy. In those scenarios, frequent MFA prompts or reauthentication can occur because continuously reevaluates the user’s sign-in risk during token refresh and session activity.

Tenant behavior may vary despite the policy condition being set to Sign-in risk = High because of:

Various risk assessments for identity protection

Frequency of token risk reevaluation

History of user risk

Token lifespan behavior and authentication context

Additional covert Microsoft-managed safeguards or security defaults

The policy may repeatedly initiate MFA and session reevaluation, which could manifest as periodic reauthentication, if the tenant regularly identifies dangerous sign-ins.

The session controls are not implemented in your current tenant since the Conditional Access policy is not activated because the sign-in events are not categorized as High risk.

You can validate this by reviewing: Entra ID → Sign-in Logs → Risk detail / Risk level / Conditional Access

This will confirm whether the affected sign-ins are actually being evaluated as High risk in both tenants.
Aditya Pande 0 Reputation points

2026-05-22T18:41:23.62+00:00

Hi Rukmini,

Thanks for clarifying this. I have investigated some of risk policies such as user risk and sign-in risk policies and compared current tenant with other tenant.

Sign-in risk policy in other tenant has control configured to require multifactor authentication and sign-in risk set as medium and above. I have attached screenshot for this.

idp_policy.png

Is this possible for prompting user for periodic reauthentication as Microsoft Managed CAP is not being applied to users as checked in sign-in logs.

If so, then can we recreate risk sign-in kind of scenario in our current tenant?
Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-05-25T09:09:12.38+00:00

Hello Aditya Pande

Yes, this is feasible. Identity Protection Sign-in Risk rules configured with "Medium and above" + "Require MFA" may nevertheless cause recurring MFA prompts or periodic reauthentication behavior even if the Microsoft-managed Conditional Access policy is not displayed as implemented in Sign-in Logs.

This happens as a result of Identity Protection's ongoing assessment of token risk and sign-in throughout session activity and token refresh processes. Users may be asked to authenticate again if dangerous signals are consistently identified.

Yes, you can recreate similar behavior in your current tenant for testing purposes by:

Setting up a policy for sign-in risk using: Sign-in risk = Medium and above; grant = Require MFA

Completing sign-ins from: Distinct geographical locations/IPs, Anonymous/Tor networks. New devices or web browsers Unknown patterns of sign-in

After testing, review: Entra ID → Sign-in Logs → Risk level / Risk detections / Conditional Access

Please be aware that Microsoft Identity Protection dynamically generates risk detections, which may differ amongst tenants based on backend risk assessment, previous signals, and user behavior.
Aditya Pande 0 Reputation points

2026-05-25T14:06:16.08+00:00

Hi Rukmini,

I am trying to edit sign-in risk policy and change it to suggested settings but it is not allowing me saying below in info button ->

This risk policy is now read-only and will be retired on October 1, 2026. To manage or modify it, migrate it to Conditional Access.

But in other tenant it is showing same in info button but policy is enabled and also updated with those settings.
Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-05-25T14:10:33.6333333+00:00

Hello Aditya Pande

The behavior difference is expected. Microsoft has started retiring legacy Identity Protection risk policies and migrating customers toward Conditional Access-based risk policies.

Since your current tenant's Sign-in Risk policy has already entered the read-only retirement phase, changes are prohibited, and the message appears:

Even though the identical informational banner is displayed, the current settings are still accessible and active in the other tenant because the policy was probably configured or altered before the retirement enforcement reached that tenant.
Aditya Pande 0 Reputation points

2026-05-25T14:41:51.8466667+00:00

Hi Rukmini,

Ok. So, do I need to migrate those to Conditional Access-based risk policy? Can you share detailed documentation for doing this process.

Thanks.
Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-05-26T10:22:53.65+00:00

Aditya Pande we will check internally and get back to you!
Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-05-28T11:19:02.51+00:00

Hello @Aditya Pande

Yes, as traditional Identity Protection risk policies are being retired and made read-only, switching to Conditional Access-based risk policies is the advised and endorsed course of action moving ahead.

If you do not migrate: Microsoft will stop supporting those legacy risk rules after October 1, 2026. If the policy is already established, it may continue to function temporarily, but new changes will eventually be prohibited.

To recreate the same functionality in Conditional Access:

Create a new Conditional Access policy

Users → select target users/groups

Cloud apps → All cloud apps

Conditions → Sign-in risk → Medium and above

Grant → Require multifactor authentication

Session → configure Sign-in frequency / Persistent browser session as needed

Enable policy in Report-only mode first, then switch to On after validation

Reference: https://learn.microsoft.com/en-in/entra/id-protection/howto-identity-protection-configure-risk-policies?
Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-05-29T09:46:05.7033333+00:00

Hello @Aditya Pande

Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Answer 1

Hello Aditya Pande

The current behavior is expected based on the Conditional Access policy configuration.

The policy is configured with Sign-in risk = High, Consequently, the policy will only take effect if a high-risk sign-in is detected. The policy and accompanying session controls won't be activated for regular sign-ins.

Settings like:Sign-in frequency, Periodic reauthentication and Persistent browser session do not work independently and only apply after the Conditional Access policy conditions are met.

Please either temporarily remove the risk criterion or establish a different test policy without the "Sign-in risk = High" condition in order to test the session controls.

Furthermore, confirm the impacted sign-ins under: Conditional Access tab under Sign-in Logs

This will verify whether the policy was assessed and implemented during the user session.

Let me know if any further queries - feel free to reach out!

Answer 2

Hello Aditya Pande,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that your implemented Conditional Access Policy not working configured for session control.

Regarding Microsoft guidance. Do not use Sign-in risk = High in the same policy if your goal is to force reauthentication for all users or all normal user sign-ins. Create two separate policies:

Risk-based policy (for risky sign-ins only)
- Users: target intended users, exclude break-glass accounts
- Resources: All resources / all cloud apps
- Condition: Sign-in risk = High
- Grant: Require MFA
- No session-control dependency for your baseline expectation This policy protects risky sign-ins only. It is not your general reauthentication policy. - https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-risk-based-sign-in, https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-risk-policies
Separate session policy (for the reauthentication requirement you actually want)
- Users: target intended users, exclude break-glass and noninteractive accounts
- Resources: All resources / all cloud apps
- Remove the Sign-in risk condition entirely
- Session:
- Sign-in frequency = 1 hour or Every time (pick one based on the business requirement)
- Persistent browser session = Never persistent Microsoft’s own reauthentication template for this scenario uses a dedicated policy and recommends testing it in Report-only first. - https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-persistent-browser, https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime, https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-session-lifetime

I hope this is helpful! Do not hesitate to let me know if you have any other questions, steps or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.