I enabled a conditional access policy on Monday that requires the user to be physically located in the country to be able to access any cloud apps logged in via their work account. However, it ended up with an issue of kicking users out of their sign ins until they clicked a prompt to sign back in every hour as it seems that Microsoft Authenticator was not constantly silently sharing the location to automatically refresh the token. After some troubleshooting, I believed the answer was due to background app usage needing to be set to 'Unrestricted', as in Microsofts article on it - [Network in Conditional Access policy - Microsoft Entra ID | Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network), it states: >The first time the user must share their location from the Microsoft Authenticator app, they receive a notification in the app. The user must open the app and grant location permissions. For the next 24 hours, if the user is still accessing the resource \*\*and granted the app permission to run in the background\*\*, the device's location is shared silently once per hour. However, when I tested that on my own device, I found that I was still required to manually click to sign back in before it pushed for the location from my mobile device. I saw further down in the article: >GPS location can be used with passwordless phone sign-in only if MFA push notifications are also enabled. Users can use Microsoft Authenticator to sign in, but they also need to approve subsequent MFA push notifications to share their GPS location. Our other conditional access policy requires multifactor authentication, so password + Authenticator for one example, so I wouldn't have thought this would be an issue, as after reading this article - [Microsoft Authenticator authentication method - Microsoft Entra ID | Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-authenticator-app), I checked what type of authentication I use for Microsoft Authenticator and it's (Notification/Code), not 'Passwordless phone sign-in'. I'm pretty stumped so far and I had contacted Microsoft support and their recommendation was to just "Use IP based location conditional access instead of GPS", which was no use to me. We do have that set up, but our IT manager wants both set up for enhanced security especially as we are moving through several cyber security insurances and certifications. Can anyone offer insight on this issue if they've set this up before? Is there something I am missing, or is it simply an issue that cannot be resolved and if we plan on using it, only restrict it to certain apps rather than all apps? Thanks in advance