When you disable a departing employee’s account, you expect their access to stop. Historically it did not, at least not right away: an access token already issued to Outlook or Teams stayed valid until it expired, usually about an hour later. Continuous access evaluation closes most of that gap. It lets Microsoft Entra ID tell Exchange Online, SharePoint Online and Teams to stop honoring a token when something important changes, so sessions end in minutes instead of whenever the token runs out.
The problem continuous access evaluation solves
Microsoft 365 apps use OAuth 2.0 access tokens. A token is a signed statement that says “this user may access this resource until this time.” Once issued, the resource (Exchange, SharePoint) trusts the token without calling home. The default lifetime is one hour, and when it expires the client asks Entra ID for a new one. That refresh is the moment policies get re-checked.
The weakness is obvious. If you reset a compromised user’s password at 10:05, an attacker holding a token issued at 10:00 could keep reading mail until around 11:00. Shortening token lifetimes would help, but Microsoft found that approach hurts reliability and user experience without removing the risk.
Continuous access evaluation (CAE) takes a different approach. It sets up a two-way conversation between Entra ID, which issues tokens, and the services that accept them. It is based on the OpenID Continuous Access Evaluation Profile standard.
How CAE works in practice
CAE covers two scenarios.
Critical event evaluation
CAE-enabled services subscribe to critical events from Entra ID. When one happens, the service rejects the user’s existing token and the client is forced back to Entra ID to re-authenticate. The events currently evaluated are:
The user account is deleted or disabled
The user’s password is changed or reset
Multifactor authentication is enabled for the user
An administrator explicitly revokes all refresh tokens for the user
Microsoft Entra ID Protection detects high user risk
Microsoft’s goal is near real-time response, but it documents that event propagation can take up to 15 minutes. Critical event evaluation does not depend on Conditional Access policies, so it works in any tenant.
Conditional Access policy evaluation
Exchange Online, SharePoint Online, Teams and Microsoft Graph can also synchronize key Conditional Access policies and enforce them inside the service. The main use is IP location. If you have a policy that only allows access from your office network and a user’s token is taken to another network, the resource sees the new IP address and rejects the token immediately. Microsoft notes that IP location enforcement is instant.
Why tokens get longer, not shorter
This part surprises people. In a CAE-aware session, access tokens can live up to 28 hours. That sounds like the opposite of security, but it makes sense: because the service can revoke the token on a critical event or a location change, the token no longer needs a short fixed lifetime to be safe. Fewer refreshes also make apps more resilient during brief service problems.
One consequence: configurable token lifetime policies are not honored for clients negotiating CAE-aware sessions. If you set custom token lifetimes years ago, check whether they still do what you think.
Which apps and clients support CAE
Both the client and the resource must support CAE. The latest versions of Outlook, Teams and OneDrive support it on web, Windows, iOS, Android and Mac. Office desktop and mobile apps (Word, Excel, PowerPoint) support it, but Office web apps do not for these scenarios. Exchange Online, SharePoint Online, Teams and Microsoft Graph are the main CAE-enabled resources.
Client
Web
Windows
iOS / Android
Mac
Outlook
Supported
Supported
Supported
Supported
Teams
Supported
Supported
Supported
Supported
OneDrive
Supported
Supported
Supported
Supported
Office (Word, Excel, PowerPoint)
Not supported
Supported
Supported
Supported
Keep clients current. CAE relies on the client understanding a “claim challenge”, where the service says the cached token is no longer good enough. Older builds do not understand it and simply keep the default one-hour behavior.
Configuring and checking CAE in your tenant
For most tenants, there is nothing to switch on. CAE is enabled automatically as part of Conditional Access. What you should do is confirm nobody turned it off and decide whether to use strict location enforcement.
Check for a disabling policy. In Entra ID > Conditional Access > Policies, look for any policy using Session > Customize continuous access evaluation set to Disable. Unless you have a documented reason, remove it.
Check legacy settings. Tenants that configured CAE in the old preview experience may see a Migrate option. Migrating creates a Conditional Access policy that reflects your old choice.
Verify in the sign-in logs. Open a recent sign-in for Outlook or Teams under Entra ID > Monitoring & health > Sign-in logs. The details show whether the session was CAE-capable.
Use the CAE Insights workbook. In Azure Monitor workbooks, the Continuous Access Evaluation Insights template highlights mismatches between the IP address Entra ID saw and the IP address the resource saw.
Strict location enforcement
By default, if Entra ID sees an allowed IP but the resource sees a different one (common with split-tunnel VPNs), CAE gives the benefit of the doubt and issues a one-hour token. Strict location enforcement, available in preview as a Conditional Access session control, removes that exception and blocks access whenever the resource sees a disallowed IP. It is the most secure option, but only use it if all your egress IP addresses are known and listed in your named locations. Test it on a small group first. Microsoft’s continuous access evaluation documentation covers the network scenarios in detail.
Limitations to know about
Guest users are not supported. Revocation and IP-based policies are not enforced instantly for guests.
Co-authoring sessions in Office may persist until the user closes the document or app, or up to an hour when an IP policy applies. SharePoint network location policies can shorten this.
Re-enabling a user right after disabling has some delay in downstream services, typically around 15 minutes for SharePoint and Teams and longer for Exchange.
Third-party apps only benefit if they are built to handle CAE claim challenges.
Putting CAE to work in your offboarding and incident response
CAE is most valuable when your processes trigger the events it listens for. When someone leaves, disable the account and revoke sessions rather than only removing licenses. When you suspect a compromise, reset the password and revoke sessions in the same step. With CAE-capable clients, those actions now cut off email, files and Teams within minutes. Our managed security team builds these steps into offboarding and incident runbooks, and the Microsoft 365 security assessment checks whether CAE has been disabled anywhere in your policies.
Frequently asked questions
Do I need a special license for continuous access evaluation?
Critical event evaluation works in any tenant. Conditional Access policy evaluation, such as IP location enforcement, requires Conditional Access, which needs Microsoft Entra ID P1 (included in Business Premium and E3/E5).
Does CAE work for service principals and apps?
There is a separate capability, CAE for workload identities, that applies location and risk policies to single-tenant service principals calling Microsoft Graph. It requires Workload ID Premium. Managed identities are not supported.
Should I disable CAE if users report extra sign-in prompts?
Usually not. Extra prompts after a password change or location change are CAE doing its job. If prompts appear without a clear cause, check for split-tunnel IP mismatches in the CAE workbook before considering any change.
Want to know how quickly your tenant can actually cut off a compromised account? Book a free Microsoft 365 security assessment and we will test your offboarding and session revocation steps with you.
When you disable a departing employee’s account, you expect their access to stop. Historically it did not, at least not right away: an access token already issued to Outlook or Teams stayed valid until it expired, usually about an hour later. Continuous access evaluation closes most of that gap. It lets Microsoft Entra ID tell Exchange Online, SharePoint Online and Teams to stop honoring a token when something important changes, so sessions end in minutes instead of whenever the token runs out.
The problem continuous access evaluation solves
Microsoft 365 apps use OAuth 2.0 access tokens. A token is a signed statement that says “this user may access this resource until this time.” Once issued, the resource (Exchange, SharePoint) trusts the token without calling home. The default lifetime is one hour, and when it expires the client asks Entra ID for a new one. That refresh is the moment policies get re-checked.
The weakness is obvious. If you reset a compromised user’s password at 10:05, an attacker holding a token issued at 10:00 could keep reading mail until around 11:00. Shortening token lifetimes would help, but Microsoft found that approach hurts reliability and user experience without removing the risk.
Continuous access evaluation (CAE) takes a different approach. It sets up a two-way conversation between Entra ID, which issues tokens, and the services that accept them. It is based on the OpenID Continuous Access Evaluation Profile standard.
How CAE works in practice
CAE covers two scenarios.
Critical event evaluation
CAE-enabled services subscribe to critical events from Entra ID. When one happens, the service rejects the user’s existing token and the client is forced back to Entra ID to re-authenticate. The events currently evaluated are:
Microsoft’s goal is near real-time response, but it documents that event propagation can take up to 15 minutes. Critical event evaluation does not depend on Conditional Access policies, so it works in any tenant.
Conditional Access policy evaluation
Exchange Online, SharePoint Online, Teams and Microsoft Graph can also synchronize key Conditional Access policies and enforce them inside the service. The main use is IP location. If you have a policy that only allows access from your office network and a user’s token is taken to another network, the resource sees the new IP address and rejects the token immediately. Microsoft notes that IP location enforcement is instant.
Why tokens get longer, not shorter
This part surprises people. In a CAE-aware session, access tokens can live up to 28 hours. That sounds like the opposite of security, but it makes sense: because the service can revoke the token on a critical event or a location change, the token no longer needs a short fixed lifetime to be safe. Fewer refreshes also make apps more resilient during brief service problems.
One consequence: configurable token lifetime policies are not honored for clients negotiating CAE-aware sessions. If you set custom token lifetimes years ago, check whether they still do what you think.
Which apps and clients support CAE
Both the client and the resource must support CAE. The latest versions of Outlook, Teams and OneDrive support it on web, Windows, iOS, Android and Mac. Office desktop and mobile apps (Word, Excel, PowerPoint) support it, but Office web apps do not for these scenarios. Exchange Online, SharePoint Online, Teams and Microsoft Graph are the main CAE-enabled resources.
Keep clients current. CAE relies on the client understanding a “claim challenge”, where the service says the cached token is no longer good enough. Older builds do not understand it and simply keep the default one-hour behavior.
Configuring and checking CAE in your tenant
For most tenants, there is nothing to switch on. CAE is enabled automatically as part of Conditional Access. What you should do is confirm nobody turned it off and decide whether to use strict location enforcement.
Entra ID > Conditional Access > Policies, look for any policy using Session > Customize continuous access evaluation set to Disable. Unless you have a documented reason, remove it.Entra ID > Monitoring & health > Sign-in logs. The details show whether the session was CAE-capable.Strict location enforcement
By default, if Entra ID sees an allowed IP but the resource sees a different one (common with split-tunnel VPNs), CAE gives the benefit of the doubt and issues a one-hour token. Strict location enforcement, available in preview as a Conditional Access session control, removes that exception and blocks access whenever the resource sees a disallowed IP. It is the most secure option, but only use it if all your egress IP addresses are known and listed in your named locations. Test it on a small group first. Microsoft’s continuous access evaluation documentation covers the network scenarios in detail.
Limitations to know about
Putting CAE to work in your offboarding and incident response
CAE is most valuable when your processes trigger the events it listens for. When someone leaves, disable the account and revoke sessions rather than only removing licenses. When you suspect a compromise, reset the password and revoke sessions in the same step. With CAE-capable clients, those actions now cut off email, files and Teams within minutes. Our managed security team builds these steps into offboarding and incident runbooks, and the Microsoft 365 security assessment checks whether CAE has been disabled anywhere in your policies.
Frequently asked questions
Do I need a special license for continuous access evaluation?
Critical event evaluation works in any tenant. Conditional Access policy evaluation, such as IP location enforcement, requires Conditional Access, which needs Microsoft Entra ID P1 (included in Business Premium and E3/E5).
Does CAE work for service principals and apps?
There is a separate capability, CAE for workload identities, that applies location and risk policies to single-tenant service principals calling Microsoft Graph. It requires Workload ID Premium. Managed identities are not supported.
Should I disable CAE if users report extra sign-in prompts?
Usually not. Extra prompts after a password change or location change are CAE doing its job. If prompts appear without a clear cause, check for split-tunnel IP mismatches in the CAE workbook before considering any change.
Want to know how quickly your tenant can actually cut off a compromised account? Book a free Microsoft 365 security assessment and we will test your offboarding and session revocation steps with you.