EntraID: The session has expired or is invalid due to sign-in frequency checks by conditional access.

Yes. This can still be a sign-in frequency or session reauthentication issue even when Conditional Access shows as successful.

AADSTS70044 means the session is expired or invalid because of a sign-in frequency check. A Conditional Access policy can evaluate successfully, but still require reauthentication. In that case, the interruption is not a policy failure; it is the result of the policy being enforced.

Given the behavior described, the most relevant checks are:

1. Inspect the exact sign-in event in Entra sign-in logs
   • Go to Entra ID > Monitoring & health > Sign-in logs.
   • Filter by:
     • Username
     • Date
     • Resource
     • Conditional Access
     • Correlation ID when available
   • Open the matching event and review:
     • Conditional Access tab
     • Troubleshooting and support tab
     • Basic Info
     • Device Info
     • Authentication Details
     • Additional Details
   • Expected outcome: identify whether reauthentication was required, and which policy enforced it.
2. Review policy details from the sign-in event, not only the policy summary
   • In the sign-in event, select the ellipsis next to the policy to see why it applied or did not apply.
   • This view shows the sign-in conditions collected at sign-in and whether they satisfied the policy requirements.
   • This is important because a policy marked as successful can still be the reason the app is being forced back for reauthentication.
3. Use the Sign-in diagnostic on the affected event
   • From Basic info > Troubleshoot Event, run the sign-in diagnostic.
   • The diagnostic can help when a sign-in should be interrupted, is interrupted unexpectedly, or when the issue involves account lock, invalid credentials, enterprise app configuration, or security defaults.
   • If the event lacks contextual analysis, review the error code insights shown for the event.
4. Check whether a sign-in frequency control is configured to reauthenticate too aggressively
   • If a Conditional Access policy is using User sign-in frequency, that can trigger reauthentication checks and produce session-expired behavior.
   • Microsoft documents that using Every time can increase security friction and can cause sign-in looping, especially without MFA.
   • For Microsoft 365 apps, time-based sign-in frequency is recommended over requiring reauthentication every time.
   • Even though this is a SAML app, the same principle applies: frequent reauthentication requirements can surface as repeated session interruptions.
5. Correlate the workaround with browser-based reauthentication
   • The fact that opening the authentication URL in a browser allows the desktop phone app to work afterward strongly suggests the app flow is depending on an existing Entra session and succeeds once a fresh browser-based authentication session is established.
   • That points more toward session state or reauthentication timing than a hard Conditional Access block.
6. Collect support-ready identifiers if escalation is needed
   • If the event is intermittent or the correlation ID from the app is not visible in logs, collect the request ID, time, and date from the closest matching sign-in event.
   • Microsoft recommends including those values in a support incident so the exact event can be located.

What to focus on in this case:

• A successful Conditional Access result does not rule out CA as the cause. It can mean the policy applied correctly and required reauthentication.
• The browser workaround suggests the desktop phone application may not be handling the reauthentication step cleanly when the Entra session no longer satisfies sign-in frequency.
• The most useful evidence will be the event-level details in Conditional Access, Troubleshooting and support, and Authentication Details, plus the sign-in diagnostic output.

About recent Microsoft-side changes: no documented recent platform change is present in the available material. The supported conclusion is limited to the documented behavior of sign-in frequency and reauthentication checks.

If the logs continue to show AADSTS70044 and the event-level details do not explain why the desktop app cannot complete reauthentication while the browser can, open a support request with the event identifiers.

References:

• Troubleshoot sign-in problems with Conditional Access
• What is the Sign-in diagnostic in Microsoft Entra ID?
• Conditional Access adaptive session lifetime policies
• How to troubleshoot Microsoft Entra sign-in errors