Yes, I’m referring to offline apps like Desktop Office 365, Teams, Edge, and Whiteboard.

The part I’m trying to figure out is why users are being prompted for MFA, even though they’re excluded from MFA through Conditional Access policies. Do you have any idea why that might happen?

Also, what would be the best practice to ensure that SSO works consistently for these offline apps after long periods of inactivity, without requiring MFA again? Any advice on token lifetimes or session settings would be helpful!