Some times it’s triggered by conditional access policy wrt device location. We have devices set to up to 30 day session if the device stays on our company network, if you take it off site or even hotspot it onto your phone you gotta sign in or provide an MFA code