Conditional Access session controls
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit ede91a9 · +25 −25 lines · also on GitHub
11
---
2
−title: Session controls in Conditional Access policy
3
−description: What are session controls in a Microsoft Entra Conditional Access policy
2
+title: "Conditional Access: Manage Session Controls Effectively"
3
+description: Learn how session controls in Microsoft Entra Conditional Access policies enable secure, limited experiences for cloud apps based on device compliance.
44
55
ms.service: entra-id
66
ms.subservice: conditional-access
77
ms.topic: article
8
−ms.date: 08/20/2025
8
+ms.date: 09/23/2025
99
1010
ms.author: joflore
1111
author: MicrosoftGuyJFlo
1212
manager: dougeby
13
−ms.reviewer:
13
+ms.reviewer: joflore
1414
---
1515
# Conditional Access: Session
1616
17
−Within a Conditional Access policy, an administrator can make use of session controls to enable limited experiences within specific cloud applications.
17
+In a Conditional Access policy, an admin can use session controls to enable limited experiences in specific cloud applications.
1818
19
−
19
+
2020
2121
## Application enforced restrictions
2222
23
−Organizations can use this control to require Microsoft Entra ID to pass device information to the selected cloud apps. The device information allows cloud apps to know if a connection is from a compliant or domain-joined device and update the session experience. When selected, the cloud app uses the device information to provide users with a limited or full experience. Limited when the device isn't managed or compliant and full when the device is managed and compliant.
23
+Organizations can use this control to require Microsoft Entra ID to pass device information to the selected cloud apps. The device information allows cloud apps to know if a connection is from a compliant or domain-joined device and update the session experience. When selected, the cloud app uses the device information to provide users with a limited or full experience. Limited if the device isn't managed or compliant, and full if the device is managed and compliant.
2424
25
−For a list of supported applications and how to configure policies, see the following articles:
25
+For a list of supported applications and steps to configure policies, see the following articles:
2626
2727
- [Idle session timeout for Microsoft 365](/microsoft-365/admin/manage/idle-session-timeout-web-apps#details-about-idle-session-timeout).
28
−- [Enabling limited access with SharePoint Online](/sharepoint/control-access-from-unmanaged-devices)
29
−- [Enabling limited access with Exchange Online](/microsoft-365/security/office-365-security/secure-email-recommended-policies#limit-access-to-exchange-online-from-outlook-on-the-web)
28
+- Learn how to enable limited access with [SharePoint Online](/sharepoint/control-access-from-unmanaged-devices).
29
+- Learn how to enable limited access with [Exchange Online](/microsoft-365/security/office-365-security/secure-email-recommended-policies#limit-access-to-exchange-online-from-outlook-on-the-web).
3030
3131
## Conditional Access application control
3232
33
−Conditional Access App Control uses a reverse proxy architecture and is uniquely integrated with Microsoft Entra Conditional Access. Microsoft Entra Conditional Access allows you to enforce access controls on your organization’s apps based on certain conditions. The conditions define what user or group of users, cloud apps, and locations and networks a Conditional Access policy applies to. After you determine the conditions, you can route users to [Microsoft Defender for Cloud Apps](/defender-cloud-apps/what-is-defender-for-cloud-apps) where you can protect data with Conditional Access App Control by applying access and session controls.
33
+Conditional Access App Control uses a reverse proxy architecture and is uniquely integrated with Microsoft Entra Conditional Access. Microsoft Entra Conditional Access lets you enforce access controls on your organization’s apps based on specific conditions. The conditions define which users, groups, cloud apps, locations, and networks a Conditional Access policy applies to. After determining the conditions, route users to [Microsoft Defender for Cloud Apps](/defender-cloud-apps/what-is-defender-for-cloud-apps) to protect data with Conditional Access App Control by applying access and session controls.
3434
35
−Conditional Access App Control enables user app access and sessions to be monitored and controlled in real time based on access and session policies. Access and session policies are used within the Defender for Cloud Apps portal to refine filters and set actions to take.
35
+Conditional Access App Control enables user app access and sessions to be monitored and controlled in real time based on access and session policies. Use access and session policies in the Defender for Cloud Apps portal to refine filters and set actions.
3636
37
−This control can be enforced with Microsoft Defender for Cloud Apps, where Admins can [Deploy Conditional Access App Control for featured apps](/defender-cloud-apps/proxy-deployment-aad) and [use Microsoft Defender for Cloud Apps session policies](/defender-cloud-apps/session-policy-aad).
37
+Enforce this control with Microsoft Defender for Cloud Apps, where admins can [deploy Conditional Access App Control for featured apps](/defender-cloud-apps/proxy-deployment-aad) and [use Microsoft Defender for Cloud Apps session policies](/defender-cloud-apps/session-policy-aad).
3838
39
−For Microsoft Edge for Business, this control can be enforced with [Microsoft Purview Data Loss Prevention](/purview/dlp-browser-dlp-learn), where Admins can [help prevent users from sharing sensitive info with Cloud Apps in Edge for Business](/purview/dlp-create-policy-prevent-cloud-sharing-from-edge-biz). The Conditional Access App Control **Custom** setting is required for apps included in these policies.
39
+For Microsoft Edge for Business, enforce this control with [Microsoft Purview Data Loss Prevention](/purview/dlp-browser-dlp-learn), where admins can [help prevent users from sharing sensitive info with cloud apps in Edge for Business](/purview/dlp-create-policy-prevent-cloud-sharing-from-edge-biz). The Conditional Access App Control **Custom** setting is necessary for apps included in these policies.
4040
4141
## Sign-in frequency
4242
43
−Sign-in frequency defines the time period before a user is asked to sign in again when attempting to access a resource. Administrators can select a period of time (hours or days) or choose to require reauthentication every time.
43
+Sign-in frequency specifies how long a user can stay signed in before being prompted to sign in again when accessing a resource. Admins can set a time period (hours or days) or require reauthentication every time.
4444
45
−Sign-in frequency setting works with apps that implement OAUTH2 or OIDC protocols according to the standards. Most Microsoft native apps for Windows, Mac, and Mobile including the following web applications follow the setting.
45
+The sign-in frequency setting works with apps that use OAuth 2.0 or OIDC protocols. Most Microsoft native apps for Windows, Mac, and mobile, including the following web applications, follow this setting.
4646
4747
- Word, Excel, PowerPoint Online
4848
- OneNote Online
⋯ 5 unchanged lines
5454
- Dynamics CRM Online
5555
- Azure portal
5656
57
−For more information, see the article [Configure authentication session management with Conditional Access](concept-session-lifetime.md#user-sign-in-frequency).
57
+For more information, see [Configure authentication session management with Conditional Access](concept-session-lifetime.md#user-sign-in-frequency).
5858
5959
## Persistent browser session
6060
61
−A persistent browser session allows users to remain signed in after closing and reopening their browser window.
61
+A persistent browser session lets users stay signed in after closing and reopening their browser window.
6262
63
−For more information, see the article [Configure authentication session management with Conditional Access](concept-session-lifetime.md#persistence-of-browsing-sessions).
63
+For more information, see [Configure authentication session management with Conditional Access](concept-session-lifetime.md#persistence-of-browsing-sessions).
6464
6565
## Customize continuous access evaluation
6666
67
−[Continuous access evaluation](concept-continuous-access-evaluation.md) is auto enabled as part of an organization's Conditional Access policies. For organizations who wish to disable continuous access evaluation, this configuration is now an option within the session control within Conditional Access. Continuous access evaluation policies can be scoped to all users or specific users and groups. Admins can make the following selection while creating a new policy or while editing an existing Conditional Access policy.
67
+[Continuous access evaluation](concept-continuous-access-evaluation.md) is auto enabled as part of an organization's Conditional Access policies. For organizations who wish to disable continuous access evaluation, this configuration is now an option within the session control within Conditional Access. Continuous access evaluation policies apply to all users or specific users and groups. Admins can make the following selection while creating a new policy or while editing an existing Conditional Access policy.
6868
69
−- **Disable** only work when **All resources (formerly 'All cloud apps')** are selected, no conditions are selected, and **Disable** is selected under **Session** > **Customize continuous access evaluation** in a Conditional Access policy. You can choose to disable all users or specific users and groups.
69
+- **Disable** works only when **All resources (formerly 'All cloud apps')** are selected, no conditions are selected, and **Disable** is selected under **Session** > **Customize continuous access evaluation** in a Conditional Access policy. You can disable all users or specific users and groups.
7070
71
−:::image type="content" source="media/concept-conditional-access-session/continuous-access-evaluation-session-controls.png" alt-text="A screenshot showing CAE Settings in a new Conditional Access policy." lightbox="media/concept-conditional-access-session/continuous-access-evaluation-session-controls.png":::
71
+:::image type="content" source="media/concept-conditional-access-session/continuous-access-evaluation-session-controls.png" alt-text="Screenshot of CAE settings in a new Conditional Access policy." lightbox="media/concept-conditional-access-session/continuous-access-evaluation-session-controls.png":::
7272
7373
## Disable resilience defaults
7474
7575
During an outage, Microsoft Entra ID extends access to existing sessions while enforcing Conditional Access policies.
7676
77
−If resilience defaults are disabled, access is denied once existing sessions expire. For more information, see the article [Conditional Access: Resilience defaults](resilience-defaults.md).
77
+If resilience defaults are disabled, access is denied when existing sessions expire. For more information, see [Conditional Access: Resilience defaults](resilience-defaults.md).
7878
7979
## Require token protection for sign-in sessions
8080
81
−Token protection (sometimes referred to as token binding in the industry) attempts to reduce attacks using token theft by ensuring a token is usable only from the intended device. When an attacker is able to steal a token, by hijacking or replay, they can impersonate their victim until the token expires or is revoked. Token theft is thought to be a relatively rare event, but the damage from it can be significant. For more information, see the article [Conditional Access: Token protection](concept-token-protection.md).
81
+Token protection, sometimes called token binding in the industry, attempts to reduce attacks using token theft by ensuring a token is usable only from the intended device. If an attacker steals a token through hijacking or replay, they can impersonate the victim until the token expires or is revoked. Token theft is rare, but its impact can be significant. For more information, see [Conditional Access: Token protection](concept-token-protection.md).
8282
8383
## Use Global Secure Access security profile
8484
85
−Using a security profile with Conditional Access unifies identity controls with network security in Microsoft's Security Service Edge (SSE) product, [Microsoft Entra Internet Access](../../global-secure-access/concept-internet-access.md#security-profiles). Selecting this Session control allows you to bring identity and context awareness to security profiles, which are groupings of various policies created and managed in Global Secure Access.
85
+Using a security profile with Conditional Access combines identity controls with network security in Microsoft's Security Service Edge (SSE) product, [Microsoft Entra Internet Access](../../global-secure-access/concept-internet-access.md#security-profiles). Selecting this Session control lets you bring identity and context awareness to security profiles, which are groupings of various policies created and managed in Global Secure Access.
8686
8787
## Related content
8888
⋯ 2 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 07:05 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.