Instead of letting an access token run until it expires, Microsoft Entra continuous access evaluation allows Microsoft Graph, Teams, SharePoint Online, Exchange Online and similar services to end a session almost straight away. Triggers include a disabled account, a password reset, revoked tokens, high user risk or a move to a different network location.
Also called continuous access evaluation.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains CAE in context, with comparison tables and the common traps.
Terms in this definition
- Access token
A credential an application hands to an API or other resource to prove what it has been authorised to do for a signed-in user. It deals with permissions, unlike the ID token, which records the sign-in itself.
- Microsoft Entra
The umbrella brand covering Microsoft's identity and network access portfolio. Internet Access, Private Access, External ID and ID Governance all belong to it, built on top of the core directory service, Entra ID.
- Microsoft Graph
API giving access to Entra and Microsoft 365 data. Authorisation uses application or delegated permissions rather than Azure RBAC.
- SharePoint Online
Part of Microsoft 365, it stores, shares and manages content in cloud-based sites and document libraries. Reports from Power BI can be embedded in its pages, and Power BI can read files kept there.
- Exchange Online
Microsoft 365's hosted service for mail, calendars and contacts. Defender for Office 365 protects these mailboxes.
- User risk
Microsoft Entra ID Protection's assessment of how likely it is that an account has been compromised, for instance because its credentials have leaked. With Microsoft Entra ID P2 it can be used as a condition in Conditional Access.
Related terms
- Revoke sessions
Cancels all of a user's refresh tokens and browser session cookies (PowerShell: Revoke-MgUserSignInSession). Apps keep their own sessions, and issued access tokens stay valid until they time out, unless CAE is supported.
- Strict location enforcement
A preview CAE mode: if the IP address a resource sees isn't one Conditional Access allows, access ends immediately, without the usual one-hour tolerance for IP mismatches.