How to Make Microsoft 365 MFA Prompts Expire More Frequently
Question details
An organization needs to increase the frequency of Microsoft 365 MFA prompts for different user risk levels, such as daily prompts for high-risk users and monthly for others.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Administrators want to override the default 90-day MFA token lifetime to enforce stricter security validations based on user roles or risks.
- Observed behavior
- By default, sign-in tokens can remain valid for up to 90 days, which does not meet the organization's requirement for daily or monthly MFA validations.
Ensure you are signed in to the Microsoft Entra admin center as at least a Conditional Access Administrator and that your organization possesses Microsoft Entra ID P1 or P2 premium licenses.
Adjust Sign-in Frequency Using Microsoft Entra Conditional Access
Create a Conditional Access policy to strictly enforce custom MFA sign-in frequencies based on user groups.
Microsoft Entra Conditional Access allows administrators to override default MFA token lifetimes by configuring custom session controls. You can create multiple policies to target different user risk profiles, such as setting a 1-day frequency for high-risk groups and a 30-day frequency for standard users.
Log in to the Microsoft Entra admin center, navigate to 'Protection' in the left sidebar, and select 'Conditional Access', then click on 'Policies'.
Click 'New policy'. Under 'Users', select the specific high-risk users or groups you want to target for daily prompts.
Under 'Access controls', click 'Grant'. Select 'Grant access' and check the box for 'Require multifactor authentication', then click 'Select'.
Under 'Access controls', click 'Session'. Check the 'Sign-in frequency' box, select 'Periodic reauthentication', enter '1', and select 'Days' from the dropdown menu.
Toggle the 'Enable policy' switch to 'On' (or 'Report-only' if you want to test it first), and click 'Create' to apply the new MFA frequency.
Looking for a Lightweight Alternative to Microsoft Office?
While securing your Microsoft 365 tenant requires advanced Entra configurations, everyday document creation shouldn't be complicated or expensive. WPS Office is a powerful, free alternative to Microsoft Office that offers seamless compatibility, a familiar interface, and lightweight performance without complex enterprise licensing requirements.
- 1. Visit the WPS Office Website: Go to the official WPS Office website on your computer.
- 2. Download the Installer: Click the 'Free Download' button to get the lightweight setup file for your operating system.
- 3. Install and Get Started: Run the installer and instantly begin opening, editing, and saving your Microsoft Office files for free.
Frequently Asked Questions
Why is the Sign-in frequency option greyed out in Conditional Access?
The Sign-in frequency control is only available if you have a compatible condition selected or if you check 'Require multifactor authentication' under the Grant section. It also requires the correct Microsoft Entra ID premium license.
Can I use security defaults instead of Conditional Access to manage MFA frequency?
No. Security defaults apply standard Microsoft security recommendations across the entire tenant and do not allow for granular customizations like daily or monthly prompt frequencies. You must disable security defaults to use Conditional Access.
What happens to active user sessions when a new sign-in frequency policy is applied?
Once the policy is enabled, users will be prompted for MFA at their next interactive sign-in, or immediately if their current session token has already exceeded the newly configured time limit.
Can I apply different MFA prompt frequencies to different applications?
Yes. In the Conditional Access policy under 'Target resources' (or 'Cloud apps or actions'), you can choose specific applications (such as Exchange Online or SharePoint) to selectively apply the stricter sign-in frequency rules.
