'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Always Persistent Browser Sessions on Azure AD Joined Devices
Question details
The user needs to resolve an issue where Conditional Access session controls for persistent browser sessions do not behave as expected when combined with device filters on Azure AD joined devices.
- Product
- Microsoft Entra ID (Azure AD) / Microsoft Intune
- Device & OS
- not provided
- Scenario
- Configuring persistent browser sessions and single sign-on (SSO) for Azure AD joined or hybrid joined devices.
- Observed behavior
- Conditional Access session controls for persistent sessions conflict with Primary Refresh Tokens (PRT) used by Azure AD joined devices, leading to unexpected single sign-on or authentication prompts.
Ensure you have Conditional Access Administrator privileges in the Microsoft Entra admin center and verify that the target devices are correctly registered as Azure AD joined or hybrid joined.
Review Policies and Use the What If Tool
Verify your Conditional Access session controls and test them using the What If tool to identify conflicts with Primary Refresh Tokens (PRT).
Azure AD joined and hybrid Azure AD joined devices automatically receive Primary Refresh Tokens (PRT) for seamless single sign-on. Because of this, standard persistent browser session settings may be bypassed or behave differently.
Using the built-in What If tool helps you simulate sign-in scenarios to pinpoint exactly which policies are affecting the device.
Sign in to the Microsoft Entra admin center, navigate to 'Protection', and select 'Conditional Access'.
Click on 'Policies' and open the specific policy causing issues. Verify the configured device filters, session controls, and exclusions.
From the main Conditional Access menu, click on 'What If' at the top of the page.
Enter the user, application, and device state details for a known Azure AD joined device, then click 'What If' to see how your policies apply to that exact scenario.
Configure Sign-in Frequency
If users must authenticate periodically instead of relying entirely on persistent sessions, define a strict sign-in frequency.
Switch to WPS Office for Lightweight, Seamless Productivity
Managing complex enterprise environments like Azure AD and Intune takes time. Simplify your daily document workflows by choosing WPS Office. It provides a familiar, fast, and free alternative to Microsoft Office, designed to help you create, edit, and share documents effortlessly.
Frequently Asked Questions
Why do Azure AD joined devices ignore persistent browser session settings?
Azure AD joined and hybrid joined devices receive Primary Refresh Tokens (PRT) during sign-in. These tokens facilitate seamless Single Sign-On (SSO) across applications, which can override standard web-based persistent browser session controls and behave differently than unmanaged devices.
What is the Conditional Access What If tool used for?
The What If tool allows administrators to simulate user sign-ins under various conditions (such as specific IP addresses, locations, or device states) to see exactly which Conditional Access policies will apply or be ignored, helping to troubleshoot access behaviors effectively.
How do I force users to re-authenticate on Azure AD joined devices?
You can force re-authentication by configuring the 'Sign-in frequency' session control within your Conditional Access policy. This ensures users are prompted for credentials or MFA after a specified period, regardless of their PRT lifecycle or persistent session status.
