FortiClient Auth Timeout

Hello,

Our FortiClient SSL VPN users connect using a username and password with a push prompt for MFA using Cisco Duo. The FortiGate has a RADIUS connection to a server running Duo proxy. Everything works great until the auth timeout is reached. When the auth timeout is reached, users are prompted to accept the MFA/Duo push but they aren't asked to sign into the FortiClient again with their username and password. All the user has to do to stay connected is to accept the MFA push without having to re-enter their credentials. I want for the users to have to re-enter their credentials plus the MFA push, not just the MFA push.

Does anyone know why this is happening?