Template family: Conditional Access
Applies to: Microsoft Entra ID
Where to find it: Secure → Conditional Access → Templates → Augmentt Default
What this template is for
Microsoft recommends disabling browser persistence for users accessing the tenant from a unmanaged device. https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-policy-persistent-browser-session
What it actually does
Who it covers. Every user in the tenant, when they sign in to all cloud apps.
Who is excluded. Service-provider (GDAP) guest accounts are excluded automatically, so your own technicians keep access if the policy misfires.
When it fires. Only when the device matches the filter device.trustType -ne "ServerAD" -or device.isCompliant -ne True.
Session controls. For sessions allowed through, it forces reauthentication every 1 hours and prevents the browser session persisting, so closing the browser signs the user out.
Deployment state. Report-only.
Augmentt deploys this template in report-only mode. Entra ID evaluates every sign-in and records what would have happened in the sign-in logs, but nothing is blocked or challenged until you switch the policy to On. Review the report-only results before enforcing.
What Augmentt asks you for at deployment
| Input | Required | Why |
excludeUsers | No | Break glass account may be excluded. |
This is an Augmentt Default template, shipped with the product and shared across all customers. Deploying it creates a new policy in the customer tenant; edit the deployed policy rather than the template.