Continuous access evaluation (CAE) explained

Continuous access evaluation (CAE) lets supporting services reject a still-valid access token when something important changes, instead of waiting up to an hour for it to expire. It’s based on the OpenID Continuous Access Evaluation Profile.

What is evaluated

Scenario	Events	Needs Conditional Access?
Critical event evaluation	User deleted or disabled; password changed or reset; MFA enabled for the user; admin revokes all refresh tokens; high user risk from ID Protection	No (any tenant)
Conditional Access policy evaluation	IP-based network location changes, enforced by Exchange Online, SharePoint Online, Teams and Microsoft Graph	Yes

Critical events are enforced in near real time, with up to 15 minutes’ latency. IP location enforcement is instant.
The client must handle a claim challenge (a 401 response that tells it to get a new token). Current Outlook, Teams, Office and OneDrive clients do, apart from some web apps.
CAE-aware sessions get long-lived tokens of up to 28 hours, because revocation is event-driven. Configurable token lifetime isn’t honoured for them. Clients that can’t use CAE keep the 1-hour default.
CAE understands only IP-based named locations. With MFA trusted IPs or country locations it issues a one-hour token without instant IP checks. Above 5,000 IP ranges across location policies, location changes aren’t enforced in real time.
If Microsoft Entra ID sees an allowed IP but the resource sees a different one (split tunnelling, proxies), CAE issues a one-hour token that suspends the IP check. Strict location enforcement (preview) removes that allowance.
Guests aren’t supported. Policy and group membership changes can take up to a day to reach resource providers. Revoke sessions to apply them at once.
CAE is on by default. To turn it off, create a policy on All resources, with no conditions, that sets Customize continuous access evaluation to Disable.

Common trap: Expecting a country-based named location to be enforced instantly by CAE - CAE only knows IP-range locations. Country and MFA trusted IP locations fall back to one-hour tokens with no instant enforcement.

Get the whole book

This note is one section of Ultra Transcenders SC-300: Microsoft Identity and Access Administrator, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to Microsoft Learn.

Amazon.co.ukKindle: coming soonPaperback: coming soon

Amazon.comKindle: coming soonPaperback: coming soon

Due on Amazon in November 2026, in Kindle and paperback editions.

About the book · SC-300 terms in the glossary · All SC-300 study notes

More SC-300 study notes

Microsoft Entra Connect Sync vs Cloud Sync, and choosing PHS, PTA or federation
How the two hybrid sync engines differ in capability and limits, and where each sign-in method checks the password.
Security defaults vs per-user MFA vs Conditional Access
The three ways to switch on MFA across a tenant, compared by licence, flexibility and what each one enforces.
Temporary Access Pass: settings, roles and how it works
What a TAP is for, its lifetime and length settings, and which role can create one for which users.
User risk vs sign-in risk in Microsoft Entra ID Protection
The difference between the two risk types, real-time versus offline detections, and which detections need P2.
Cross-tenant access settings: inbound, outbound and trust
How default and per-organisation settings control B2B collaboration and B2B direct connect, and when MFA and device claims are trusted.
System-assigned vs user-assigned managed identities
How the two managed identity types differ in lifecycle and sharing, when to choose each, and the Azure roles needed to manage them.
Application objects vs service principals in Microsoft Entra ID
Why every app has a global definition and a per-tenant instance, the three service principal types, and what happens when you change or delete one.