What MFA reauthentication schedule do you use for Microsoft 365? Is it required at every sign-in, on a fixed interval such as 12 hours, 5 days, or 30 days, or only when users connect from new devices, unfamiliar networks, or elevated-risk locations? It would also be helpful to know your organization's approximate size and industry, along with how you chose the policy. Do administrators, managed devices, mobile access, VPN, or Windows Hello for Business use different rules?
5 Answers
We use risk-based Conditional Access rather than one interval for everyone. A compliant, managed device with a low-risk sign-in may rarely prompt, while unfamiliar devices, risky sign-ins, or sensitive applications trigger MFA immediately. Administrators have stricter policies and use phishing-resistant security keys whenever they authenticate. Windows Hello for Business also makes the experience mostly seamless because it counts as MFA.
We require MFA for every valid session, but the practical experience depends on the authentication method. Most employees use passkeys or Windows Hello, so unlocking a managed device satisfies the requirement without repeated password prompts. Unmanaged devices are not allowed to keep sessions and must authenticate each time.
For standard users, we use a sign-in frequency of roughly 5–30 days depending on the service and device, with risk policies able to prompt sooner. Managed devices can retain sessions, but unmanaged devices have to authenticate every time or are blocked entirely. Mobile access is limited through application-management controls.
The main goal is to avoid relying on a ‘trusted network’ as the security boundary. Network location alone should not exempt someone from MFA. Device compliance, phishing-resistant authentication, sign-in risk, user risk, and the sensitivity of the application are better signals than a fixed calendar interval.
Administrative accounts reauthenticate much more often—about every 4 or 12 hours in our environment—and always when a login prompt appears. Regular users are usually on a 12- or 24-hour session window, with more frequent prompts for VPN or other sensitive services.
That is close to our setup too. Windows Hello for Business handles most normal sign-ins, while elevated risk or access to particularly sensitive applications causes a step-up prompt.