Why You Keep Getting MFA Prompts on Trusted Devices

Someone asked me last week why their laptop keeps prompting for MFA even though they tick "don't ask again for 14 days" every single time. Fair question, and the answer isn't obvious unless you know what Entra ID is actually checking behind that box.

What "remember this device" really tracks

That checkbox doesn't remember the device the way you'd think. It sets a session cookie tied to the browser profile and the sign in session, not to the machine itself. Clear your browser cache, use a different browser, open a private window, or get a new Windows profile pushed down by IT, and that trust is gone. So is it reset if a conditional access policy changes, if your account risk level goes up, or if you sign in from a network Entra hasn't seen from you before.

There's also a difference between "remember MFA" and device trust through Intune or hybrid join. If your device isn't actually registered with Entra ID, even a fully compliant looking machine gets treated as unknown every time, and unknown means prompt again.

The usual culprits

A few things I see over and over when someone says MFA won't stop nagging them:

• The device was never actually Entra joined or hybrid joined, it just looks compliant in Intune.
• A conditional access policy requires MFA on every sign in for a specific app, which overrides the general "remember for 14 days" setting.
• The user is bouncing between a browser and a native app (Outlook desktop vs Outlook on the web), and each one keeps its own session state.
• IP address changes a lot, working from home one day and a coffee shop the next, which can trip sign in risk detection.
• Someone reset the "revoke MFA sessions" setting for the whole tenant, which logs everyone out of their trust at once. This one is easy to forget you did.

What actually helps

If it's one user, check Entra ID sign in logs for that account and look at the conditional access column, it'll usually tell you exactly which policy triggered the prompt. If it's everyone, check whether a global admin ran "Require re-registration" or revoked sessions tenant wide, that's a common cause after a security incident or an audit.

Registering the device properly with Entra join or hybrid join fixes more of these complaints than anything else. It's a bit of setup work, but it's the difference between a device Entra actually recognizes and one that just looks fine on the surface.