User removed from MFA group but legacy sessions still prompt

Scenario

A user is excluded from a prompt path, but existing sessions or cached tokens still behave as if MFA is required.

Recommended Resolution Path

1. Confirm the live policy evaluation in sign-in logs after the group change.
2. Have the user fully sign out and restart the session rather than relying on partial token refresh.
3. Check whether another Conditional Access policy still applies.
4. Document the expected propagation and session cache behavior for support staff.

Technician Notes

Confirm the result, document the root cause, and record any preventative action worth standardizing.