Merge pull request #106765 from vtsarik/patch-2

Add details about periodic session key roll on (H)AADJ-ed devices

Author: Court72

articles/active-directory/devices/concept-primary-refresh-token.md

@@ -36,7 +36,7 @@ The following Windows components play a key role in requesting and using a PRT:
 A PRT contains claims found in most Azure AD refresh tokens. In addition, there are some device-specific claims included in the PRT. They are as follows:
 
 * **Device ID**: A PRT is issued to a user on a specific device. The device ID claim `deviceID` determines the device the PRT was issued to the user on. This claim is later issued to tokens obtained via the PRT. The device ID claim is used to determine authorization for Conditional Access based on device state or compliance.
-* **Session key**: The session key is an encrypted symmetric key, generated by the Azure AD authentication service, issued as part of the PRT. The session key acts as the proof of possession when a PRT is used to obtain tokens for other applications.
+* **Session key**: The session key is an encrypted symmetric key, generated by the Azure AD authentication service, issued as part of the PRT. The session key acts as the proof of possession when a PRT is used to obtain tokens for other applications. Session key is rolled on  Windows 10 or newer Azure AD joined or Hybrid Azure AD joined devices if it's older than 30 days.
 
 ### Can I see what’s in a PRT?
 
@@ -133,6 +133,9 @@ A PRT can get a multifactor authentication (MFA) claim in specific scenarios. Wh
 
 Windows 10 or newer maintain a partitioned list of PRTs for each credential. So, there’s a PRT for each of Windows Hello for Business, password, or smartcard. This partitioning ensures that MFA claims are isolated based on the credential used, and not mixed up during token requests.
 
+> [!NOTE]
+> When using password to sign into Windows 10 or newer Azure AD joined or Hybrid Azure AD joined device, MFA during WAM interactive sign in may be required after session key associated with PRT is rolled.
+
 ## How is a PRT invalidated?
 
 A PRT is invalidated in the following scenarios: