• Commodity
  • 2 minutes to read

Keep me signed in (KMSI) displays a Stay signed in? prompt later a user successfully signs in. If a user answers Yep to this prompt, the go on me signed in service gives them a persistent refresh token. For federated tenants, the prompt volition evidence after the user successfully authenticates with the federated identity service.

The following diagram shows the user sign-in period for a managed tenant and federated tenant and the new proceed me signed in prompt. This menses contains smart logic then that the Stay signed in? option won't exist displayed if the auto learning system detects a high-risk sign-in or a sign-in from a shared device.

Diagram showing the user sign-in flow for a managed vs. federated tenant

Note

Configuring the keep me signed in option requires you to utilise Azure Agile Directory (Azure Advertizement) Premium 1, Premium 2, or Basic editions, or to have a Microsoft 365 license. For more information about licensing and editions, see Sign up for Azure AD Premium.

Azure AD Premium and Basic editions are available for customers in China using the worldwide instance of Azure Advertizing. Azure Advertizement Premium and Basic editions aren't currently supported in the Azure service operated by 21Vianet in Mainland china. For more information, talk to usa using the Azure AD Forum.

Configure KMSI

  1. Sign in to the Azure portal using a Global administrator account for the directory.

  2. Select Azure Active Directory, select Visitor branding, and and so select Configure.

  3. In the Advanced settings section, notice the Testify option to remain signed in setting.

    This setting lets you choose whether your users remain signed in to Azure AD until they explicitly sign out.

    • If y'all choose No, the Stay signed in? option is hidden after the user successfully signs in and the user must sign in each time the browser is airtight and reopened.
    • If you cull Yes, the Stay signed in? selection is shown to the user.

    Screenshot shows the Show option to remain signed in setting

Troubleshoot sign-in problems

If a user doesn't act on the Stay signed in? prompt, as shown in the following diagram, but abandons the sign-in attempt, y'all'll see a sign-in log entry that indicates the interrupt.

Shows the Stay signed in? prompt

Details about the sign-in error are as follows and highlighted in the example.

  • Sign in error code: 50140
  • Failure reason: This error occurred due to "Keep me signed in" interrupt when the user was signing in.

Example sign-in log entry with the keep me signed in interrupt

Yous tin can finish users from seeing the interrupt past setting the Show option to remain signed in setting to No in the avant-garde branding settings. This disables the KMSI prompt for all users in your Azure Advertisement directory.

You lot as well tin use the persistent browser session controls in conditional access to forestall users from seen the KMSI prompt. This selection allows you to disable the KMSI prompt for a select grouping of users (such as the global administrators) without affecting sign-in beliefs for the remaining users in the directory. For more than information, see User sign-in frequency.

To ensure that the KMSI prompt is shown only when it tin can benefit the user, the KMSI prompt is intentionally non shown in the following scenarios:

  • User is signed in via seamless SSO and integrated Windows hallmark (IWA)
  • User is signed in via Active Directory Federation Services and IWA
  • User is a guest in the tenant
  • User'southward risk score is loftier
  • Sign-in occurs during user or admin consent flow
  • Persistent browser session control is configured in a conditional admission policy

Next steps

Learn about other settings that touch sign-in session timeout:

  • Microsoft 365 – Idle session timeout
  • Azure AD Conditional Access - User sign-in frequency
  • Azure portal – Directory-level inactivity timeout