title: Conditional Access Policy does not affect MSAL app - user not asked to reauthenticate
body: <p>Azure AD Premium has the concept of Conditional Access Policies. When you change the sign-in frequency it doesn't affect the access token or refresh token lifetime.
  Since the access token has a default lifetime of 1 hour, no matter what you set the sign-in frequency to in Azure, after 1 hour the refresh token will be used to fetch a new access token.
  So setting a sign-in frequency in Azure AD premium has no effect on a default msal app.</p>
  <p>And indeed I tested this by doing the following simple steps:</p>
  <p>Download the msal angular sample that uses auth code flow with PKCE (<a href="https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/lib/msal-angular" rel="nofollow noreferrer">https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/lib/msal-angular</a>)
  Add an Conditional Access Policy in Azure AD premium on the app registration for the app above
  Make sure the policy is applied when the user signs in (e.g. by checking Sign Ins blade or what-if tool on Enterprise app).</p>
  <p>Below is the conditional access policy:
  <a href="https://i.stack.imgur.com/sCSQU.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/sCSQU.png" alt="enter image description here" /></a></p>
  <p>Below tenant configuration shows that the user cannot select the &quot;Stay signed in?&quot; option when signing into any application in this tenant.</p>
  <p><a href="https://i.stack.imgur.com/RmgwY.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/RmgwY.png" alt="enter image description here" /></a></p>
  <p>Below the relevant parts of the results of <code>dsregcmd /status</code>. I am aware the SSO status has an effect on Conditional Access Policies.</p>
  <pre><code>+----------------------------------------------------------------------+
  | Device State                                                         |
  +----------------------------------------------------------------------+
  
               AzureAdJoined : NO
            EnterpriseJoined : NO
                DomainJoined : YES
                  DomainName : &lt;redacted&gt;
                 Device Name : &lt;redacted&gt;
  
  +----------------------------------------------------------------------+
  | User State                                                           |
  +----------------------------------------------------------------------+
  
                      NgcSet : YES
                    NgcKeyId : &lt;redacted&gt;
                    CanReset : NO
             WorkplaceJoined : YES
            WorkAccountCount : 2
               WamDefaultSet : NO
  
  +----------------------------------------------------------------------+
  | SSO State                                                            |
  +----------------------------------------------------------------------+
  
                  AzureAdPrt : NO
         AzureAdPrtAuthority : NO
               EnterprisePrt : NO
      EnterprisePrtAuthority : NO
  </code></pre>