CA policy, MFA and Sign-in Frequency

Question

Hello everyone,

I have a lot of doubts about how CA, MFA and Sign-in frequency works between them.

I understand that if I have 100 Enterprise application and I create a CA policy with All Cloud Apps, with a certain Sign-in Frequency, it's not sure it does work because it depends on the specific application. But then, is there a way to enforce MFA or Password + MFA every specific period of time (e.g., every 24 hours?)

Thanks.

Answer 1

Yes, but with important limits.

• MFA can be enforced with Conditional Access by using a Grant control such as requiring multifactor authentication or an authentication strength.
• Sign-in frequency controls when reauthentication is required again. It does not run on a fixed clock for all users at the same time.
• Reauthentication happens when the session is evaluated and a new access token is needed. If the app does not request a new token in the way expected, the experience can vary by application.

For a 24-hour reauthentication pattern:

1. Create or edit a Conditional Access policy.
2. Target the needed users.
3. Under Cloud apps or actions, select the apps to protect. All resources / All cloud apps can be used, but behavior still depends on whether the app supports the relevant authentication flow.
4. Under Access controls > Grant, require multifactor authentication or an authentication strength.
5. Under Session, select Sign-in frequency.
6. Choose Periodic reauthentication and set it to 1 day.

What this means in practice:

• It is not a guaranteed “prompt every 24 hours exactly” timer for every app and every user.
• It is based on the user’s last successful authentication and on token/session evaluation.
• Users will therefore be prompted at different times, depending on when they last authenticated and when the application requests a new token.
• Microsoft Entra ID’s default sign-in frequency is a rolling 90 days unless changed by policy.
• Sign-in frequency now applies to MFA as well, not only first-factor authentication.

Important caveats:

• Every time is more disruptive and can increase MFA fatigue. Microsoft recommends limiting its use and often prefers time-based sign-in frequency for Microsoft 365 workloads.
• With Every time, the system includes five minutes of clock skew, so users are not prompted more often than once every five minutes.
• Reauthentication does not occur continuously during an already established session just because the configured interval passed. It happens when access to a resource requires a new token.
• If a network disruption forces a session to be re-established after the configured interval, users can be prompted again.

So the direct answer is:

• Yes, a policy can be configured to require Password + MFA again after a period such as 24 hours, by combining a Grant control for MFA with Sign-in frequency = Periodic reauthentication, 1 day.
• No, there is no supported way to make all users across all apps reauthenticate at the exact same fixed time every day through Conditional Access alone.

---

References:

• Conditional Access adaptive session lifetime policies
• Configure adaptive session lifetime policies
• Inconsistent MFA Prompts Despite Conditional Access Policy - Microsoft Q&A
• Require multifactor authentication for elevated sign-in risk
• Frequently asked questions around Microsoft Entra ID Protection