How often do you make people reauthenticate for Microsoft 365?

I would separate requiring MFA at sign-in from how often users have to sign in again. You can require MFA for every sign-in but still let an existing session continue for a while.

One approach is a 12-hour session interval with MFA at each new sign-in. Other examples range from several days to 30 days for regular users, so the interval is really a separate policy choice.

Risk-based Conditional Access is another option. Low-risk sign-ins from compliant managed devices might prompt less often, while higher-risk activity triggers more frequent checks. Some apps can have stricter requirements too.

A trusted location can be one factor, but I would not treat being on the company network as sufficient trust by itself.

Admin accounts deserve a shorter leash than ordinary user accounts. Examples include reauthentication every four or 12 hours, or requiring a security key each time. Separate administrative accounts can also have policies distinct from everyday user accounts.

Device management makes a big difference. One policy uses a 24-hour sign-in frequency on managed devices with Windows Hello for Business, while requiring sign-in every time for access from unmanaged devices. A longer interval for managed mobile devices is another option.

That can feel quite different from a password and phone prompt every day, so compare the actual user experience, not just the number of hours in the policy.

Watch the workload for people juggling multiple accounts and domains. A daily interval can turn into several MFA prompts before lunch. That does not settle the security policy, but it is worth considering when choosing the interval and testing it with different roles.