MFA Frequency Guide

This article explains the frequency settings for Multi Factor Authentication (MFA).  As well as the frequency of prompts per application/device. 

What Users will Experience with Default MFA Settings:

Default Settings for Applications: For each desktop and mobile application used, you will be prompted for MFA once until you perform one of the actions listed below, then you will receive the MFA prompt again.

Default Settings for Browsers: For each browser you use, you will be prompted for MFA once and as long as you say "yes" to stay signed in, you will not receive an MFA prompt until you perform one of the actions below. If you select "no" on stay signed in, then you will be required to complete MFA again after you close your browser window.

ITS recommends selecting “yes” to the browser prompt below, to receive fewer authentication requests and stay signed into your regularly used device. Otherwise, users will be prompted again for MFA when you close and reopen your browser.

List of Example Actions that will Cause Microsoft to Prompt for MFA: 

• Switching to a new browser 

• Switching to a new device  

• If a device, browser, or Office desktop/mobile application is not used for 90 days or more  

• Resetting your SU password  

• Clearing browser cookies (or using a browser that is setup to clear cookies after it is closed or is setup not to save any cookies) 

• The maximum number of days between sign-ins is met for high priority systems (see MFA sign-in frequency chart below)

• Not selecting “Yes” on the “Keep me signed-in” pop-up box  

• Signing out of a Microsoft 365 application  

• Using an incognito/private browser window  

• Having two or more Microsoft school or work accounts registered with your windows device  

• ITS revoking MFA sessions if your device is lost or stolen 

• Your MFA settings are cleared and require you to re-register with MFA  

• When Microsoft prompts you to “Allow my organization to manage this device” 

• Microsoft verifying your password recovery information is still correct once every 180 days 

• Microsoft labels the user as a risky user based on sign-in activity and will prompt MFA again to ensure security 

• Drastic changes in a device’s IP address such as drastically changing locations from where you historically work

Exceptions to MFA Default Settings: 

Individual applications can have their own MFA prompt frequency outside of the default setting. These are used when systems contain highly sensitive information. The non-default frequencies are noted in the table below and vary based on the application. 

An application owner can request a sign in frequency different from the default experience if they desire.  A custom sign-in frequency for an application can range from once per hour to once per 365 days. 

Applications Setup to Use MFA: 

*System is not currently using MFA but there are plans to support MFA by June 2023.