Skip to content

Documentation / Knowledge Base

Users are repeatedly signed out and disconnected

When a User Authentication trust requirement uses Microsoft Entra ID, users may be repeatedly signed out of Enclave, often once an hour, and lose their connections until they sign in again. This is usually caused by a Conditional Access sign-in frequency in your tenant. Enclave is doing what that policy requires, so the fix is in Entra ID.

Symptoms

  • Peers that the user reaches through a policy with a User Authentication trust requirement go down, then come back once the user signs in again.
  • This happens repeatedly, typically 60 to 90 minutes after each sign-in.
  • Each time, the user gets an Enclave login required notification.
  • Peers reached through policies without a User Authentication trust requirement stay connected.
  • On Windows, the desktop app log (%TEMP%\enclave-tray-logs) shows Failed to refresh access token with Azure AD at the time of each disconnect.

Cause

Enclave keeps a user signed in by silently refreshing their access token shortly before it expires. Entra ID access tokens last between 60 and 90 minutes by default.

The Conditional Access Sign-in frequency session control makes Entra ID refuse silent refreshes once that period has passed since the user last signed in interactively. When a refresh is refused, Enclave signs the user out and asks them to sign in again. The trust requirement is no longer met, so tunnels that depend on it close until the user signs in.

If the sign-in frequency is about the same as or shorter than the access token lifetime, nearly every refresh is refused, so users are disconnected each time their access token expires.

When more than one Conditional Access policy applies to a sign-in, Entra ID enforces all of them. The shortest sign-in frequency therefore takes effect, even if a broader policy sets a longer one.

Resolution

Confirm the cause

  1. In the Microsoft Entra admin centre, open Sign-in logs and select User sign-ins (non-interactive). Enclave's silent token refreshes are recorded there, not under interactive sign-ins.
  2. Filter by the affected user and the Enclave Agent application, and look for failures at the times the user was disconnected.
  3. Open a failed entry and check the failure reason and the Conditional Access tab to see which policy required the user to sign in again.

Change the sign-in frequency

  1. Find the Conditional Access policies with a Sign-in frequency session control that apply to your Enclave users. Check policies that target Enclave's applications (Enclave Agent or Enclave Trust Broker) as well as those that target all resources.
  2. Set the sign-in frequency to how often you want users to sign in again, well above 90 minutes. For example, the length of a working day.
  3. Ask affected users to sign in once more. They then stay connected until the new sign-in frequency has passed.

Notes

  • Any sign-in frequency signs users out of Enclave once it has passed. They are disconnected at the first token refresh after that and stay disconnected until they sign in again. Choose a value that matches how often you want users to sign in.
  • A token lifetime policy is different. A shorter access token lifetime only makes Enclave refresh more often; it does not make users sign in again. See Token Refresh.

Having problems? Contact us at support@enclave.io or visit our support options.

Last updated October 28, 2026