- Since 2018, Microsoft has used an X.509 certificate to author sign its NuGet packages. That certificate will be expiring by the end of January 2021. As early as November 1st, a new certificate will replace it as the new Microsoft author signing certificate for NuGet packages.
- Jul 15, 2021 My microsoft office 365 looks like it has expired. Can you help me reactivatae it. Technician's Assistant: What version of Microsoft Office are you using? Technician's Assistant: Have you updated Microsoft Office recently? No I don't think so.
- Sep 24, 2019 Go to Applications Utilities Key Chain Access delete all the items you find about “ Office ”. Then sign in to check if the issue occurs. Then sign in to check if the issue occurs. If you still have the issue, we wanna collect more information to further solve.
Sep 15, 2019 the authentication session has expired. Please sign-in again. Mac ( problem ) hello, I just subscribed and bought office and I am facing a problem with activation, a message comes and says ' the authentication session has expired. Please sign-in again. The operating system software is up to date, and I have the lates version of Office 365. I have the family plan for Office 365, and it installed without problem on my other Mac laptop. Any help will be appreciated.
-->
In complex deployments, organizations might have a need to restrict authentication sessions. Some scenarios might include:
- Resource access from an unmanaged or shared device
- Access to sensitive information from an external network
- High impact users
- Critical business applications
Conditional Access controls allow you to create policies that target specific use cases within your organization without affecting all users.
Before diving into details on how to configure the policy, let’s examine the default configuration.
User sign-in frequency
Sign-in frequency defines the time period before a user is asked to sign in again when attempting to access a resource.
The Azure Active Directory (Azure AD) default configuration for user sign-in frequency is a rolling window of 90 days. Asking users for credentials often seems like a sensible thing to do, but it can backfire: users that are trained to enter their credentials without thinking can unintentionally supply them to a malicious credential prompt.
It might sound alarming to not ask for a user to sign back in, in reality any violation of IT policies will revoke the session. Some examples include (but are not limited to) a password change, an incompliant device, or account disable. You can also explicitly revoke users’ sessions using PowerShell. The Azure AD default configuration comes down to “don’t ask users to provide their credentials if security posture of their sessions has not changed”.
The sign-in frequency setting works with apps that have implemented OAUTH2 or OIDC protocols according to the standards. Most Microsoft native apps for Windows, Mac, and Mobile including the following web applications comply with the setting.
- Word, Excel, PowerPoint Online
- OneNote Online
- Office.com
- Microsoft 365 Admin portal
- Exchange Online
- SharePoint and OneDrive
- Teams web client
- Dynamics CRM Online
- Azure portal
The sign-in frequency setting works with SAML applications as well, as long as they do not drop their own cookies and are redirected back to Azure AD for authentication on regular basis.
User sign-in frequency and multi-factor authentication
Sign-in frequency previously applied to only to the first factor authentication on devices that were Azure AD joined, Hybrid Azure AD joined, and Azure AD registered. There was no easy way for our customers to re-enforce multi factor authentication (MFA) on those devices. Based on customer feedback, sign-in frequency will apply for MFA as well.
User sign-in frequency and device identities
Your Session Has Expired
If you have Azure AD joined, hybrid Azure AD joined, or Azure AD registered devices, when a user unlocks their device or signs in interactively, this event will satisfy the sign-in frequency policy as well. In the following two examples user sign-in frequency is set to 1 hour:
Example 1:
- At 00:00, a user signs in to their Windows 10 Azure AD joined device and starts work on a document stored on SharePoint Online.
- The user continues working on the same document on their device for an hour.
- At 01:00, the user is prompted to sign in again based on the sign-in frequency requirement in the Conditional Access policy configured by their administrator.
Example 2:
- At 00:00, a user signs in to their Windows 10 Azure AD joined device and starts work on a document stored on SharePoint Online.
- At 00:30, the user gets up and takes a break locking their device.
- At 00:45, the user returns from their break and unlocks the device.
- At 01:45, the user is prompted to sign in again based on the sign-in frequency requirement in the Conditional Access policy configured by their administrator since the last sign-in happened at 00:45.
Persistence of browsing sessions
A persistent browser session allows users to remain signed in after closing and reopening their browser window.
The Azure AD default for browser session persistence allows users on personal devices to choose whether to persist the session by showing a “Stay signed in?” prompt after successful authentication. If browser persistence is configured in AD FS using the guidance in the article AD FS Single Sign-On Settings, we will comply with that policy and persist the Azure AD session as well. You can also configure whether users in your tenant see the “Stay signed in?” prompt by changing the appropriate setting in the company branding pane in Azure portal using the guidance in the article Customize your Azure AD sign-in page.
Configuring authentication session controls
Conditional Access is an Azure AD Premium capability and requires a premium license. If you would like to learn more about Conditional Access, see What is Conditional Access in Azure Active Directory?
Warning
If you are using the configurable token lifetime feature currently in public preview, please note that we don’t support creating two different policies for the same user or app combination: one with this feature and another one with configurable token lifetime feature. Microsoft retired the configurable token lifetime feature for refresh and session token lifetimes on January 30, 2021 and replaced it with the Conditional Access authentication session management feature.
Before enabling Sign-in Frequency, make sure other reauthentication settings are disabled in your tenant. If 'Remember MFA on trusted devices' is enabled, be sure to disable it before using Sign-in frequency, as using these two settings together may lead to prompting users unexpectedly. To learn more about reauthentication prompts and session lifetime, see the article, Optimize reauthentication prompts and understand session lifetime for Azure AD Multi-Factor Authentication.
Policy 1: Sign-in frequency control
Create new policy
Choose all required conditions for customer’s environment, including the target cloud apps.
Note
It is recommended to set equal authentication prompt frequency for key Microsoft Office apps such as Exchange Online and SharePoint Online for best user experience.
Go to Access Controls > Session and click Sign-in frequency
Enter the required value of days and hours in the first text box
Select a value of Hours or Days from dropdown
Save your policy
On Azure AD registered Windows devices sign in to the device is considered a prompt. For example, if you have configured the sign-in frequency to 24 hours for Office apps, users on Azure AD registered Windows devices will satisfy the sign-in frequency policy by signing in to the device and will be not prompted again when opening Office apps.
Policy 2: Persistent browser session
Create new policy
Choose all required conditions.
Note
Please note that this control requires to choose “All Cloud Apps” as a condition. Browser session persistence is controlled by authentication session token. All tabs in a browser session share a single session token and therefore they all must share persistence state.
Go to Access Controls > Session and click Persistent browser session
Select a value from dropdown
Save you policy
Note
Persistent Browser Session configuration in Azure AD Conditional Access will overwrite the “Stay signed in?” setting in the company branding pane in the Azure portal for the same user if you have configured both policies.
Validation
Use the What-If tool to simulate a login from the user to the target application and other conditions based on how you configured your policy. The authentication session management controls show up in the result of the tool.
Policy deployment
Authentication Session Has Expired Microsoft Office
To make sure that your policy works as expected, the recommended best practice is to test it before rolling it out into production. Ideally, use a test tenant to verify whether your new policy works as intended. For more information, see the article Plan a Conditional Access deployment.
Known issues
- If you configure sign-in frequency for mobile devices, authentication after each sign-in frequency internal would be slow (can take 30 seconds on average). Also, it could happen across various apps at the same time.
- In iOS devices, if an app configures certificates as the first authentication factor and the app has both Sign-in frequency and Intune mobile application management policies applied, the end-users will be blocked from signing in to the app when the policy is triggered.
Next steps
- If you are ready to configure Conditional Access policies for your environment, see the article Plan a Conditional Access deployment.