How to Set Different Azure AD Sign-In Frequencies for Desktop and Mobile
Question details
The administrator needs to enforce different Azure Active Directory sign-in frequency requirements based on the user's device platform, specifically separating desktop and mobile policies.
- Product
- Azure Active Directory
- Device & OS
- Windows, macOS, iOS, Android
- Scenario
- Configuring enterprise Conditional Access policies to require mobile users to sign in every seven days while prompting desktop users every 12 hours.
- Observed behavior
- The goal is to successfully apply two distinct sign-in frequency intervals without causing policy conflicts between mobile and desktop environments.
Ensure you have the necessary Azure AD Premium P1 or P2 licenses assigned to your tenant and that you possess Conditional Access Administrator or Global Administrator privileges before modifying security policies.
Create Platform-Specific Conditional Access Policies
By creating two separate Conditional Access policies, you can target specific device platforms and apply distinct sign-in frequency controls for mobile and desktop environments.
Azure Active Directory allows you to use device platforms as a condition in your access policies. To achieve different sign-in frequencies, you must split your configuration: one policy targeting mobile operating systems and another targeting desktop operating systems.
Log in to the Microsoft Entra admin center (formerly Azure portal). Navigate to Protection > Conditional Access > Policies and click 'New policy'. Name it appropriately (e.g., 'Mobile Sign-in Frequency'). Under 'Conditions', select 'Device platforms', include 'Android' and 'iOS', and exclude all others.
In the same policy, navigate to the 'Session' section under 'Access controls'. Check the 'Sign-in frequency' box, enter '7', and select 'Days' from the dropdown menu.
Create a second Conditional Access policy (e.g., 'Desktop Sign-in Frequency'). Under 'Conditions' > 'Device platforms', configure the policy to include 'Windows' and 'macOS'.
Navigate to the 'Session' section for this new desktop policy. Check the 'Sign-in frequency' box, enter '12', and select 'Hours' from the dropdown menu.
Set the 'Enable policy' toggle at the bottom of both policies to 'Report-only' initially to verify their impact in the sign-in logs. Once confirmed that they behave as expected, change the toggle to 'On' and click 'Save'.
Choose WPS Office for a Cost-Effective Productivity Suite
While managing enterprise identity and access often ties organizations to the Microsoft ecosystem, you can optimize your software licensing costs by adopting WPS Office. It provides powerful document editing, spreadsheet analysis, and presentation tools without the heavy subscription fees.
- 1. Download the Installer: Visit the official WPS Office website and download the free version for your respective Windows or Mac desktop.
- 2. Install WPS Office: Run the downloaded executable file and follow the straightforward on-screen instructions to complete the setup.
- 3. Start Creating: Launch WPS Office and immediately begin working on documents, spreadsheets, and presentations with high compatibility.
Frequently Asked Questions
Can I set a sign-in frequency for a specific application instead of all apps?
Yes. Within your Conditional Access policy, you can specify individual cloud applications (such as Office 365 or Salesforce) under the 'Target resources' or 'Cloud apps or actions' section, applying the sign-in frequency exclusively to those applications.
What happens if a user is accidentally targeted by both a 12-hour and a 7-day sign-in frequency policy?
If policies conflict, Azure AD generally enforces the most restrictive policy. In this overlap scenario, the user would be prompted to sign in every 12 hours. Proper platform targeting prevents this issue.
Do I need a premium license to set sign-in frequencies?
Yes, configuring advanced session controls like sign-in frequency requires an Azure AD Premium P1 or P2 license for the targeted users.
How can I verify which policy applied to a user's sign-in?
You can review the 'Sign-in logs' in the Microsoft Entra admin center. Click on a specific sign-in event and navigate to the 'Conditional Access' tab to see which policies were applied, reported, or not applied.
