Question

Contoso allows employees to access Microsoft 365 web apps from personal, unmanaged devices. Security requires that on these devices users must re-authenticate every 4 hours and that browser sessions must not persist after the browser is closed. On corporate Entra-joined devices, users should retain a normal persistent session. You need to configure Conditional Access to meet these requirements while affecting only unmanaged devices. What should you configure?

Accepted Answer

Create a Conditional Access policy scoped using a filter for unmanaged devices, and under Session set Sign-in frequency to 4 hours and Persistent browser session to 'Never persistent'.

Answer

Create a Conditional Access policy targeting all users and cloud apps with a device filter for compliant/hybrid-joined devices, and set Sign-in frequency to 4 hours with Persistent browser session set to 'Never persistent'.

Answer

Configure a tenant-wide sign-in frequency of 4 hours in the authentication session management defaults and disable 'Stay signed in' for all users.

Answer

Create an Intune app protection policy that enforces a 4-hour timeout and blocks browser persistence on personal devices.