The settings which make up the experienceĪzure AD has a default sign-in frequency of 90 days, this might seem like a long time but there are some scenario’s which require the user to sign in again, like: Functionality may change, even right after this post has been published. In this article I’m going to explain the different options available and where to configure what setting so that you can govern your own reauthentication settings.ĭisclaimer: This post reflects the status of assigning groups to Azure AD roles as of October 21, 2020. You might want some users in your organization to authenticate more often than others based on their risk profile.

You want users to reauthenticate more often when using a certain cloud application which you make available via Azure AD single sign on.You want users to reauthenticate more often when they come from a non-managed or non-registered device.So you might understand that how reauthentication must be configured really depends per company and per scenario, so luckily Microsoft provides options which you can configure. Reauthentication can take place by asking for a single factor, like password, FIDO, the password less option in the Microsoft Authenticator app or by using Multi Factor Authentication (MFA) Governing when users receive authentication prompts when authenticating to Azure Active Directory (Azure AD) is depending on more than one setting, on which functionalities are in use and also in which scenario you authenticate (Browser, Modern clients or other).

Azure mfa for windows login