Sign-in frequency
In Microsoft Entra Conditional Access, sign-in frequency is a session control that sets when a user must authenticate again as access to a resource is evaluated.
A reauthentication policy is not a universal expiry timer
Sign-in frequency controls how often Entra asks for authentication again. It does not mean every application session ends at the same instant or that an access token’s lifetime becomes identical to the configured interval.
Enforcement depends on the application returning to Entra for authentication and on when the session is evaluated. Microsoft documents cases where enforcement is deferred until interaction resumes. An application’s own session behavior therefore matters when testing the policy.
Even the “Every time” setting needs that context. Closing and reopening a browser does not necessarily produce a fresh prompt if the application has not requested a new authentication evaluation.
Sign-in frequency also answers a different question from authentication strength: when authentication must be refreshed, rather than which method combinations are acceptable. What an MFA claim means explains why a visible prompt and the recorded authentication result need to be interpreted together.
Keep incident containment separate
Changing this policy is not evidence that a stolen session has stopped working. During an incident, verify the effect of the relevant revocation and account actions on the affected resources. The identity containment review focuses on that gap between an administrative change and observed loss of access.