You have an Azure Active Directory (Azure AD) tenant that has Security defaults disabled.

[Reference:, According to the Microsoft Identity and Access Administrator (SC-300) Study Guide and Microsoft Learn module “Implement Conditional Access policies”, a Conditional Access policy in Azure AD determines how access decisions are enforced based on user, application, and session signals., When the goal is to prompt for MFA, this control is found in the Grant settings section of the policy configuration. The Grant control allows administrators to require specific conditions such as multi-factor authentication, device compliance, hybrid Azure AD join, or app protection. The official Microsoft documentation specifies:, “To require users to perform multi-factor authentication, navigate to the ‘Grant’ section of your Conditional Access policy and select ‘Grant access’ → ‘Require multi-factor authentication’.”, Therefore, the first answer (for requiring MFA) corresponds to Grant settings., On the other hand, if you want to ensure that a user is reauthenticated periodically — for example, every eight hours — this is configured under the Session settings section. Session controls define user experience within the session after access is granted. Microsoft documentation states:, “Session controls enable limiting user sessions, such as enforcing reauthentication frequency, requiring sign-in every X hours, or restricting persistent browser sessions.”, Hence, to prompt User1 to authenticate every eight hours, the appropriate configuration is within Session settings., , , , , ]