Conditional Access using Duo not requiring MFA authentication after initial approval

We have an app registration, Unanet, that we have setup with SSO using Azure conditional access with Duo MFA  and after the user initially authenticates through Azure login and Duo approval the users when they use the SSO feature on the app it shows authentication through Azure but no longer requires the Duo MFA authentication.  I have tried changing sign in frequency to several different types (1hr, 6hr, 12hr) and nothing seems to make a difference and was wondering what else I should try?