Session Control

CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser

Non-persistent browser session

About this policy

The CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser policy stops browser sessions from persisting for privileged role holders. When an admin ticks stay signed in, this policy overrules it, so closing the browser ends the session and the next visit needs a fresh sign-in. It applies to all cloud apps for the included admin roles. A small nuisance for admins, but a big win if a shared or unmanaged machine is ever left unattended with an admin session open.

Policy conditions

Users: Specific users
Apps: All cloud apps

JSON template

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "@odata.type": "#microsoft.graph.conditionalAccessPolicy",
  "@odata.id": "identity/conditionalAccess/policies('74229684-f4c0-48fc-9151-6571576520e3')",
  "@odata.editLink": "identity/conditionalAccess/policies('74229684-f4c0-48fc-9151-6571576520e3')",
  "templateId": null,
  "displayName": "CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser",
  "createdDateTime@odata.type": "#DateTimeOffset",
  "modifiedDateTime@odata.type": "#DateTimeOffset",
  "state@odata.type": "#microsoft.graph.conditionalAccessPolicyState",
  "state": "enabled",
  "deletedDateTime": null,
  "grantControls": null,
  "partialEnablementStrategy": null,
  "conditions": {
    "@odata.type": "#microsoft.graph.conditionalAccessConditionSet",
    "userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "userRiskLevels": [],
    "signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "signInRiskLevels": [],
    "clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)",
    "clientAppTypes": [
      "browser"
    ],
    "platforms": null,
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "@odata.type": "#microsoft.graph.conditionalAccessApplications",
      "includeApplications@odata.type": "#Collection(String)",
      "includeApplications": [
        "All"
      ],
      "excludeApplications@odata.type": "#Collection(String)",
      "excludeApplications": [],
      "includeUserActions@odata.type": "#Collection(String)",
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences@odata.type": "#Collection(String)",
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "@odata.type": "#microsoft.graph.conditionalAccessUsers",
      "includeUsers@odata.type": "#Collection(String)",
      "includeUsers": [],
      "excludeUsers@odata.type": "#Collection(String)",
      "excludeUsers": [],
      "includeGroups@odata.type": "#Collection(String)",
      "includeGroups": [],
      "excludeGroups@odata.type": "#Collection(String)",
      "excludeGroups": [
        "2802b872-ccfb-4b29-a9a9-459808dfb11b",
        "b89d30c2-3cbb-4431-aaad-c866aec9d7ba"
      ],
      "includeRoles@odata.type": "#Collection(String)",
      "includeRoles": [
        "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
        "c4e39bd9-1100-46d3-8c65-fb160da0071f",
        "b0f54661-2d74-4c50-afa3-1ec803f12efe",
        "158c047a-c907-4556-b7ef-446551a6b5f7",
        "b1be1c3e-b65d-4f19-8427-f6fa0d97feb9",
        "29232cdf-9323-42fd-ade2-1d097af3e4de",
        "62e90394-69f5-4237-9190-012177145e10",
        "729827e3-9c14-49f7-bb1b-9608f156bbb8",
        "966707d0-3269-4727-9be2-8c3a10f19b9d",
        "7be44c8a-adaf-4e2a-84d6-ab2649e08a13",
        "e8611ab8-c189-46e8-94e1-60213ab1f814",
        "194ae4cb-b126-40b2-bd5b-6091b380977d",
        "f28a1f50-f6e7-4571-818b-6a12f2af6b6c",
        "fe930be7-5e62-47db-91af-98c3a49a38b1",
        "3a2c62db-5318-420d-8d74-23affee5d9d5",
        "db506228-d27e-4b7d-95e5-295956d6615f",
        "6b942400-691f-4bf0-9d12-d8a254a2baf5",
        "d2562ede-74db-457e-a7b6-544e236ebb61",
        "e93e3737-fa85-474a-aee4-7d3fb86510f3",
        "b6a27b2b-f905-4b2e-81b5-0d90e0ef1fdb",
        "1707125e-0aa2-4d4d-8655-a7c786c76a25",
        "69091246-20e8-4a56-aa4d-066075b2a7a8",
        "11451d60-acb2-45eb-a7d6-43d0f0125c13"
      ],
      "excludeRoles@odata.type": "#Collection(String)",
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    }
  },
  "sessionControls": {
    "@odata.type": "#microsoft.graph.conditionalAccessSessionControls",
    "disableResilienceDefaults": null,
    "applicationEnforcedRestrictions": null,
    "cloudAppSecurity": null,
    "signInFrequency": null,
    "continuousAccessEvaluation": null,
    "secureSignInSession": null,
    "blockSensitiveActions": null,
    "persistentBrowser": {
      "@odata.type": "#microsoft.graph.persistentBrowserSessionControl",
      "mode@odata.type": "#microsoft.graph.persistentBrowserSessionMode",
      "mode": "never",
      "isEnabled": true
    }
  },
  "#microsoft.graph.restore": {
    "title": "microsoft.graph.restore",
    "target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('74229684-f4c0-48fc-9151-6571576520e3')/microsoft.graph.restore"
  },
  "Tag": "jv-CAF-2026.2.1",
  "summary": "The CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser policy stops browser sessions from persisting for privileged role holders. When an admin ticks stay signed in, this policy overrules it, so closing the browser ends the session and the next visit needs a fresh sign-in. It applies to all cloud apps for the included admin roles. A small nuisance for admins, but a big win if a shared or unmanaged machine is ever left unattended with an admin session open."
}