Q1: In testing Conditional Access Session Controls for Windows 365 MFA, we would like users to be always be prompted for MFA when accessing cloud PC via web or RDP client, however the session control option for "Every Time" is greyed out and a disclaimer indicating this is not supported for selected apps (W365 and AVD). Is this a bug or are there plans to support "Every Time" for Cloud PCs?

Q2: In testing Conditional Access Session Controls for Windows 365 MFA, we configure users to be prompted every 4 hours, however if the user is already authenticated via Azure AD, they are not prompted at all. It appears from testing users get MFA prompted at the first connection to the tenant only but following connections to W365 do not. Is there something missing in the configuration?