Session Control

CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency

Sign-in frequency enforced

About this policy

The CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency policy caps how long an admin session can live. Anyone holding one of the included privileged roles is asked to reauthenticate every twelve hours across all cloud apps. Admin tokens are a prize target, so limiting their lifetime shrinks the window an attacker has to abuse a stolen session. Twelve hours is a fair balance, long enough to get through a working day, short enough that forgotten sessions do not stay valid for long.

Policy conditions

Users: Specific users
Apps: All cloud apps

JSON template

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "@odata.type": "#microsoft.graph.conditionalAccessPolicy",
  "@odata.id": "identity/conditionalAccess/policies('831e394e-32c9-46d2-b09d-8c760e210f79')",
  "@odata.editLink": "identity/conditionalAccess/policies('831e394e-32c9-46d2-b09d-8c760e210f79')",
  "templateId": null,
  "displayName": "CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency",
  "createdDateTime@odata.type": "#DateTimeOffset",
  "modifiedDateTime@odata.type": "#DateTimeOffset",
  "state@odata.type": "#microsoft.graph.conditionalAccessPolicyState",
  "state": "enabled",
  "deletedDateTime": null,
  "grantControls": null,
  "partialEnablementStrategy": null,
  "conditions": {
    "@odata.type": "#microsoft.graph.conditionalAccessConditionSet",
    "userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "userRiskLevels": [],
    "signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "signInRiskLevels": [],
    "clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)",
    "clientAppTypes": [
      "all"
    ],
    "platforms": null,
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "@odata.type": "#microsoft.graph.conditionalAccessApplications",
      "includeApplications@odata.type": "#Collection(String)",
      "includeApplications": [
        "All"
      ],
      "excludeApplications@odata.type": "#Collection(String)",
      "excludeApplications": [],
      "includeUserActions@odata.type": "#Collection(String)",
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences@odata.type": "#Collection(String)",
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "@odata.type": "#microsoft.graph.conditionalAccessUsers",
      "includeUsers@odata.type": "#Collection(String)",
      "includeUsers": [],
      "excludeUsers@odata.type": "#Collection(String)",
      "excludeUsers": [],
      "includeGroups@odata.type": "#Collection(String)",
      "includeGroups": [],
      "excludeGroups@odata.type": "#Collection(String)",
      "excludeGroups": [
        "2802b872-ccfb-4b29-a9a9-459808dfb11b",
        "5dcf5173-9efb-4f3f-a19d-2f03760d4e1d"
      ],
      "includeRoles@odata.type": "#Collection(String)",
      "includeRoles": [
        "c4e39bd9-1100-46d3-8c65-fb160da0071f",
        "b0f54661-2d74-4c50-afa3-1ec803f12efe",
        "b1be1c3e-b65d-4f19-8427-f6fa0d97feb9",
        "29232cdf-9323-42fd-ade2-1d097af3e4de",
        "62e90394-69f5-4237-9190-012177145e10",
        "f2ef992c-3afb-46b9-b7cf-a126ee74c451",
        "729827e3-9c14-49f7-bb1b-9608f156bbb8",
        "3a2c62db-5318-420d-8d74-23affee5d9d5",
        "194ae4cb-b126-40b2-bd5b-6091b380977d",
        "fe930be7-5e62-47db-91af-98c3a49a38b1",
        "f28a1f50-f6e7-4571-818b-6a12f2af6b6c",
        "db506228-d27e-4b7d-95e5-295956d6615f",
        "6b942400-691f-4bf0-9d12-d8a254a2baf5",
        "d2562ede-74db-457e-a7b6-544e236ebb61",
        "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
        "b6a27b2b-f905-4b2e-81b5-0d90e0ef1fdb",
        "1707125e-0aa2-4d4d-8655-a7c786c76a25",
        "966707d0-3269-4727-9be2-8c3a10f19b9d",
        "69091246-20e8-4a56-aa4d-066075b2a7a8",
        "11451d60-acb2-45eb-a7d6-43d0f0125c13",
        "158c047a-c907-4556-b7ef-446551a6b5f7",
        "7be44c8a-adaf-4e2a-84d6-ab2649e08a13",
        "e8611ab8-c189-46e8-94e1-60213ab1f814",
        "e93e3737-fa85-474a-aee4-7d3fb86510f3"
      ],
      "excludeRoles@odata.type": "#Collection(String)",
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    }
  },
  "sessionControls": {
    "@odata.type": "#microsoft.graph.conditionalAccessSessionControls",
    "disableResilienceDefaults": null,
    "applicationEnforcedRestrictions": null,
    "cloudAppSecurity": null,
    "persistentBrowser": null,
    "continuousAccessEvaluation": null,
    "secureSignInSession": null,
    "blockSensitiveActions": null,
    "signInFrequency": {
      "@odata.type": "#microsoft.graph.signInFrequencySessionControl",
      "value": 12,
      "type@odata.type": "#microsoft.graph.signinFrequencyType",
      "type": "hours",
      "authenticationType@odata.type": "#microsoft.graph.signInFrequencyAuthenticationType",
      "authenticationType": "primaryAndSecondaryAuthentication",
      "frequencyInterval@odata.type": "#microsoft.graph.signInFrequencyInterval",
      "frequencyInterval": "timeBased",
      "isEnabled": true
    }
  },
  "#microsoft.graph.restore": {
    "title": "microsoft.graph.restore",
    "target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('831e394e-32c9-46d2-b09d-8c760e210f79')/microsoft.graph.restore"
  },
  "Tag": "jv-CAF-2026.2.1",
  "summary": "The CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency policy caps how long an admin session can live. Anyone holding one of the included privileged roles is asked to reauthenticate every twelve hours across all cloud apps. Admin tokens are a prize target, so limiting their lifetime shrinks the window an attacker has to abuse a stolen session. Twelve hours is a fair balance, long enough to get through a working day, short enough that forgotten sessions do not stay valid for long."
}