Session Control

CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices

Sign-in frequency enforced

About this policy

The CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices policy enforces a twelve hour sign-in frequency for internal users on Windows and macOS devices that are not managed. A device filter identifies compliant, company owned machines and leaves them alone, so the reauthentication prompt only lands on personal or unknown devices. It is a nice compromise, letting people work from their own hardware while making sure a session on an untrusted machine cannot quietly live on for weeks.

Policy conditions

Users: Specific users
Apps: All cloud apps
Platforms: windows, macOS

JSON template

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "@odata.type": "#microsoft.graph.conditionalAccessPolicy",
  "@odata.id": "identity/conditionalAccess/policies('f1cedeec-d6a4-49c4-a8b9-cf6c43a6f16e')",
  "@odata.editLink": "identity/conditionalAccess/policies('f1cedeec-d6a4-49c4-a8b9-cf6c43a6f16e')",
  "templateId": null,
  "displayName": "CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices",
  "createdDateTime@odata.type": "#DateTimeOffset",
  "modifiedDateTime@odata.type": "#DateTimeOffset",
  "state@odata.type": "#microsoft.graph.conditionalAccessPolicyState",
  "state": "enabled",
  "deletedDateTime": null,
  "grantControls": null,
  "partialEnablementStrategy": null,
  "conditions": {
    "@odata.type": "#microsoft.graph.conditionalAccessConditionSet",
    "userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "userRiskLevels": [],
    "signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "signInRiskLevels": [],
    "clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)",
    "clientAppTypes": [
      "all"
    ],
    "locations": null,
    "times": null,
    "deviceStates": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "@odata.type": "#microsoft.graph.conditionalAccessApplications",
      "includeApplications@odata.type": "#Collection(String)",
      "includeApplications": [
        "All"
      ],
      "excludeApplications@odata.type": "#Collection(String)",
      "excludeApplications": [],
      "includeUserActions@odata.type": "#Collection(String)",
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences@odata.type": "#Collection(String)",
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "@odata.type": "#microsoft.graph.conditionalAccessUsers",
      "includeUsers@odata.type": "#Collection(String)",
      "includeUsers": [],
      "excludeUsers@odata.type": "#Collection(String)",
      "excludeUsers": [],
      "includeGroups@odata.type": "#Collection(String)",
      "includeGroups": [
        "ceeac9b8-ddf5-48cb-afcb-e2ab8bfd1a57"
      ],
      "excludeGroups@odata.type": "#Collection(String)",
      "excludeGroups": [
        "2802b872-ccfb-4b29-a9a9-459808dfb11b",
        "663dad60-a2c9-4228-afa5-a39fef078ad7"
      ],
      "includeRoles@odata.type": "#Collection(String)",
      "includeRoles": [],
      "excludeRoles@odata.type": "#Collection(String)",
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    },
    "platforms": {
      "@odata.type": "#microsoft.graph.conditionalAccessPlatforms",
      "includePlatforms@odata.type": "#Collection(microsoft.graph.conditionalAccessDevicePlatform)",
      "includePlatforms": [
        "windows",
        "macOS"
      ],
      "excludePlatforms@odata.type": "#Collection(microsoft.graph.conditionalAccessDevicePlatform)",
      "excludePlatforms": []
    },
    "devices": {
      "@odata.type": "#microsoft.graph.conditionalAccessDevices",
      "includeDeviceStates@odata.type": "#Collection(String)",
      "includeDeviceStates": [],
      "excludeDeviceStates@odata.type": "#Collection(String)",
      "excludeDeviceStates": [],
      "includeDevices@odata.type": "#Collection(String)",
      "includeDevices": [],
      "excludeDevices@odata.type": "#Collection(String)",
      "excludeDevices": [],
      "deviceFilter": {
        "@odata.type": "#microsoft.graph.conditionalAccessFilter",
        "mode@odata.type": "#microsoft.graph.filterMode",
        "mode": "exclude",
        "rule": "device.deviceOwnership -eq \"Company\" -or device.isCompliant -eq True"
      }
    }
  },
  "sessionControls": {
    "@odata.type": "#microsoft.graph.conditionalAccessSessionControls",
    "disableResilienceDefaults": null,
    "applicationEnforcedRestrictions": null,
    "cloudAppSecurity": null,
    "persistentBrowser": null,
    "continuousAccessEvaluation": null,
    "secureSignInSession": null,
    "blockSensitiveActions": null,
    "signInFrequency": {
      "@odata.type": "#microsoft.graph.signInFrequencySessionControl",
      "value": 12,
      "type@odata.type": "#microsoft.graph.signinFrequencyType",
      "type": "hours",
      "authenticationType@odata.type": "#microsoft.graph.signInFrequencyAuthenticationType",
      "authenticationType": "primaryAndSecondaryAuthentication",
      "frequencyInterval@odata.type": "#microsoft.graph.signInFrequencyInterval",
      "frequencyInterval": "timeBased",
      "isEnabled": true
    }
  },
  "#microsoft.graph.restore": {
    "title": "microsoft.graph.restore",
    "target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('f1cedeec-d6a4-49c4-a8b9-cf6c43a6f16e')/microsoft.graph.restore"
  },
  "Tag": "jv-CAF-2026.2.1",
  "summary": "The CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices policy enforces a twelve hour sign-in frequency for internal users on Windows and macOS devices that are not managed. A device filter identifies compliant, company owned machines and leaves them alone, so the reauthentication prompt only lands on personal or unknown devices. It is a nice compromise, letting people work from their own hardware while making sure a session on an untrusted machine cannot quietly live on for weeks."
}