Skip to content

policy-all-users-persistent-browser.md

Latest commit

 

History

History
47 lines (37 loc) · 2.57 KB

policy-all-users-persistent-browser.md

File metadata and controls

47 lines (37 loc) · 2.57 KB
title Require reauthentication with Conditional Access
description Create a custom Conditional Access policy requiring reauthentication.
ms.topic how-to
ms.date 03/24/2026
ms.reviewer lhuangnorth

Require reauthentication and disable browser persistence

Overview

Protect user access on unmanaged devices by preventing browser sessions from remaining signed in after the browser is closed and setting a sign-in frequency to 1 hour.

User exclusions

[!INCLUDE active-directory-policy-exclusions]

[!INCLUDE active-directory-policy-deploy-template]

Create a Conditional Access policy

  1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
  2. Browse to Entra ID > Conditional Access > Policies.
  3. Select New policy.
  4. Give your policy a name. Create a meaningful standard for the names of your policies.
  5. Under Assignments, select Users or workload identities.
    1. Under Include, select All users
    2. Under Exclude, select Users and groups and choose your organization's emergency access or break-glass accounts.
  6. Under Target resources > Resources (formerly cloud apps) > Include, select All resources (formerly 'All cloud apps').
  7. Under Conditions > Filter for devices, set Configure to Yes.
    1. Under Devices matching the rule:, set to Include filtered devices in policy.
    2. Under Rule syntax select the Edit pencil and paste the following expressing in the box, then select Apply.
      1. device.trustType -ne "ServerAD" -or device.isCompliant -ne True
    3. Select Done.
  8. Under Access controls > Session
    1. Select Sign-in frequency, specify Periodic reauthentication, and set the duration to 1 and the period to Hours.
    2. Select Persistent browser session, and set Persistent browser session to Never persistent.
    3. Select, Select
  9. Confirm your settings and set Enable policy to Report-only.
  10. Select Create to enable your policy.

[!INCLUDE conditional-access-report-only-mode]

Related content

Conditional Access templates

Use report-only mode for Conditional Access to determine the results of new policy decisions.