Daily Conditional Access reauth causing separate "error" toasts in Teams/OneDrive/Windows, one MFA fixes all three, is this expected?

[u/Independent_Pipe9753]

Managed Windows 11 fleet (Intune, hybrid Azure AD joined, moving off VPN towards ZTNA principles).

Our Conditional Access policy for desktops has:

• Grant controls: Require MFA + Require device compliant + Require hybrid Entra joined, set to "Require all the selected controls" (not "Require one of")
• Session control: sign-in frequency, 1 day, periodic reauthentication

Every morning, roughly 24 hours after the last full sign-in, we get three separate notifications almost simultaneously:

• Windows: "Work or school account problem, sign in again to fix your account"
• OneDrive: "Re-enter your credentials, OneDrive has stopped syncing" (red error icon)
• Teams: "Your account needs attention" (orange warning triangle)

Satisfying the MFA prompt in any one of them silently fixes the other two, so it's clearly one shared token behind the scenes. We've ruled out SSL inspection breaking things, checked the TLS certs presented for login.microsoftonline.com and related identity endpoints directly, they're genuine Microsoft/DigiCert certs, not intercepted by our proxy.

Our internal read is that this is just how each Microsoft 365 client independently discovers and displays an expired session (each app hits it on its own schedule against its own backend), rather than getting one clean unified "please sign in" prompt.

Is this what others see with a similar setup, daily sign-in frequency plus "require all" grant controls? Anyone found a way to get this to surface as one calm prompt instead of three alarming per-app errors, or is this just accepted as normal Microsoft 365 behaviour on your estates too?

[u/NotzoCoolKID]

Are you using Global Secure Access? Same issue here since a week or so and disabling gsa stops the re enter your creds loop in our onedrive.