A financial services company allows employees to access a sensitive payroll web application from personal, unmanaged devices. Security requires that users be forced to re-authenticate every 4 hours during their session with this app, rather than remaining signed in for the default period. Which Conditional Access session control should the administrator configure to meet this requirement?