How to disable the "Don't ask again for X days" step for specific applications?

Question

How to disable the "Don't ask again for X days" step for specific applications?

Martin Trinh 6

If you have an application configured with conditional access for the session to expire after 1 day, but generally have the "Don't ask again for X days", you will still be prompted whether you want to be remembered for X days, even though you will have to re-authenticate after 1 day again anyways. Is there a way to disable this prompt for that specific application?

1 answer

Your answer

Answer 1

Yugandhar Munagala 341 Microsoft Employee Moderator

Hello @Martin Trinh ,

This is a global setting and cannot be disabled on a particular application, if you would like to disable it for your whole org, then you can do it under the below path,

AAD -> security -> multifactor authentication -> Additional cloud-based multifactor authentication settings -> uncheck the option for Allow users to remember multi-factor authentication on devices they trust.

Hope this helps.

Let us know if this answer was helpful to you or if you need additional assistance. If it was helpful, please remember to accept it and complete the quality survey so that others in the community with similar questions can more easily find a rated solution.

Martin Trinh 6 Reputation points

2022-07-21T08:37:13.303+00:00

Hi @Yugandhar Munagala ,

Thanks for the quick answer and I guess I just have to accept it, if there is currently no configuration option on an application basis.. Please note however, that this results in a workflow where users are suggested their session can actually be remembered for X days, but in fact it cannot due to stricter session expiration which was set for good reasons. I hope that you would agree that this is bad user experience.

Is Microsoft planning on implementing the option to allow configuration of this per application?
Yugandhar Munagala 341 Reputation points Microsoft Employee Moderator

2022-07-21T17:48:50.137+00:00

Hello @Martin Trinh ,

Agree with your point. Let me check with the engineering team if there is a plan to enable configuration of this per application. It might take some time to get a response, but I will get back to you on this.

Thanks!
Yugandhar Munagala 341 Reputation points Microsoft Employee Moderator

2022-07-22T00:30:59.357+00:00

Hello @Martin Trinh ,

Discussed this internally,
The "Remember multi-factor authentication" is a setting under per-user MFA, service settings. Hence it should not be used along with Conditional Access Sign-in frequency, due to unwanted behaviors.

With Conditional Access (CA) you can set the sign-in frequency per application.
If you do not have a premium license to use Conditional Access, then you can use per-user MFA and can choose the above setting to allow users to remember MFA.

Currently I don't think there are any plans to introduce a feature (under per user MFA) to allow configuration per application.

Thanks
JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2022-07-25T18:05:51.713+00:00

@Martin Trinh
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Share via

How to disable the "Don't ask again for X days" step for specific applications?

1 answer

Your answer