Fix Azure AD Conditional Access MFA Not Prompting for Reauthentication
Question details
Users are not being prompted for MFA reauthentication by Azure AD Conditional Access policies, despite sign-in frequency settings being configured.
- Product
- Azure Active Directory (Microsoft Entra ID)
- Device & OS
- not provided
- Scenario
- An IT admin has configured Conditional Access policies (including third-party MFA like Duo) with a specific sign-in frequency, but Outlook mobile and browser sessions bypass or skip the reauthentication prompt.
- Observed behavior
- Mobile tokens and browser sessions do not behave like a standard password prompt for every session, allowing users to continue accessing apps without completing the expected MFA reauthentication challenge.
Ensure you have Conditional Access Administrator or Security Administrator privileges in your Microsoft Entra ID tenant to view and modify security policies and sign-in logs.
Verify Conditional Access Policy and Review Sign-in Logs
Check that your Conditional Access policy correctly targets the intended users and apps, and use Azure AD sign-in logs to diagnose why the MFA prompt is being bypassed.
Conditional Access sign-in frequency and mobile token behavior can be complex. A one-hour frequency policy does not necessarily force a hard password prompt for every single mobile session if the primary refresh token is still considered valid or if a third-party MFA provider is misconfigured.
Navigate to the Microsoft Entra admin center, go to Protection > Conditional Access > Policies. Select your policy and ensure it correctly applies to the intended Users, Target resources (like Office 365 cloud apps), and Conditions (such as specific device platforms or client apps).
In the same policy, check the 'Grant' section under Access controls. Confirm that your specific third-party integration (e.g., Duo) is explicitly selected as the required authentication control.
Go to Identity > Monitoring & health > Sign-in logs. Find a recent sign-in attempt from an affected user. Click on the log entry, navigate to the 'Conditional Access' tab, and check if the policy result shows as 'Applied', 'Skipped', or 'Not Applied' to understand the failure point.
Ask an affected user to clear their browser cache or sign out entirely from Outlook mobile. Initiate a newly registered mobile session or use an in-private browser window to see if the fresh token generation triggers the MFA prompt properly.
If users can still dismiss an MFA prompt and continue working, gather the specific sign-in logs and policy Correlation IDs, and open a support case with Microsoft Entra or your third-party MFA provider (like Duo) for deeper token analysis.
Looking for a Hassle-Free Office Solution? Try WPS Office
While resolving complex enterprise authentication issues like Azure AD Conditional Access, you or your users might need immediate access to a reliable productivity suite. WPS Office provides a lightweight, highly compatible, and free alternative to Microsoft Office that doesn't rely on complex cloud token policies for local offline editing.
- 1. Download the installer: Visit the official WPS Office website and click the Free Download button.
- 2. Install the application: Run the downloaded installer file and follow the simple on-screen instructions to complete the setup.
- 3. Open and edit your documents: Launch WPS Office to instantly open, edit, and save your existing Word, Excel, and PowerPoint files without complex sign-in hurdles.
Frequently Asked Questions
Why does a 1-hour sign-in frequency policy not prompt Outlook mobile users immediately?
Sign-in frequency policies rely on session tokens. Rich client applications like Outlook mobile use primary refresh tokens (PRTs) and background authentication mechanisms. If the app seamlessly refreshes the token in the background before the session expires, the user may not see a visible prompt, or the prompt behavior may be suppressed by mobile OS token caching.
How can I tell if my Conditional Access policy is actually targeting the right users?
You can use the 'What If' tool located in the Microsoft Entra admin center under Protection > Conditional Access. Enter the specific user, target application, and device platform to simulate a sign-in and verify if your policy evaluates as expected.
Can third-party MFA providers like Duo interfere with Azure AD prompts?
Yes. If Custom Controls are used for third-party MFA like Duo, they must be strictly configured in the Conditional Access 'Grant' controls. If Azure AD satisfies its own session requirements and doesn't explicitly mandate the custom control for that specific session refresh, the third-party prompt might be skipped.
