How to Deploy Microsoft Entra ID Continuous Access Evaluation (CAE) for Real-Time Session Revocation

Traditional identity management architectures rely on access tokens with fixed lifespans. When a user logs into Microsoft 365, Entra ID evaluates Conditional Access policies and issues a JSON Web Token (JWT), typically valid for one hour. If that user’s laptop is stolen, or their account is compromised and disabled by an administrator 10 minutes later, the attacker can still use the valid JWT to access Exchange Online or SharePoint for the remaining 50 minutes. This latency in revocation is a massive vulnerability in modern Zero Trust architectures.

Microsoft mitigates this via Continuous Access Evaluation (CAE). CAE establishes a real-time, bi-directional signalling channel between Microsoft Entra ID (the identity provider) and the resource providers (like Exchange Online and SharePoint). When a critical security event occurs, CAE revokes the token instantly—terminating active sessions in near real-time.

This guide explains how CAE functions architecturally, the critical events it monitors, and how to configure and enforce it within an enterprise tenant.

Understanding CAE Architecture

In a standard Oauth2/OIDC flow, the resource provider (e.g., SharePoint) blindly trusts the access token until its expiry timestamp is reached. It does not phone home to Entra ID for every single API call (which would cause catastrophic latency).

With CAE, the architecture is inverted. The resource provider maintains a persistent event listener connected to Entra ID. When an administrator disables an account, Entra ID immediately pushes a “Critical Event” signal to SharePoint. SharePoint instantly adds that user’s token to a local blocklist and forces the client application to re-authenticate, regardless of the token’s remaining lifespan.

CAE listens for the following Critical Events:

• User account is deleted or disabled.
• User password is changed or reset.
• Multi-Factor Authentication (MFA) is enabled for the user.
• Administrator explicitly revokes all refresh tokens for a user.
• High user risk detected by Entra ID Identity Protection (e.g., leaked credentials).

CAE also listens for Conditional Access Policy Evaluation. If a user moves from a trusted corporate IP to an untrusted public coffee shop IP, CAE detects the network change and instantly revokes the session if a Conditional Access policy dictates that access is only allowed from corporate networks.

Step 1: Enabling CAE in the Entra Admin Center

CAE is rolling out as a default-enabled feature for new tenants, but it is highly recommended to explicitly configure it via Conditional Access to ensure it is enforced exactly according to your security posture.

1. Navigate to the Microsoft Entra admin center (entra.microsoft.com).
2. Go to Protection > Conditional Access.
3. Click New policy.
4. Name: Enforce Continuous Access Evaluation (Global).
5. Under Users, select All users (ensure you exclude your Break-Glass emergency admin accounts).
6. Under Target resources, select All cloud apps.

Step 2: Configuring the Session Controls

The enforcement of CAE is handled in the Session controls of the Conditional Access policy.

1. Under the Access controls section, select Session.
2. Check the box for Customize continuous access evaluation.
3. Change the dropdown from Disable to Strict enforcement.
4. Click Select.

Note on Strict vs. Report-only: If your network infrastructure utilizes complex NATting, split-tunnel VPNs, or proxy servers that frequently change the user’s egress IP address mid-session, Strict Enforcement may cause continuous, disruptive re-authentication prompts (as CAE constantly triggers network location changes). It is highly recommended to run the policy in Report-only mode for two weeks to analyze logs before flipping to Enforce.

Step 3: Auditing CAE Interventions

Once CAE is active, you must be able to audit when and why it terminates a user’s session. This data is exposed in the Entra ID Sign-in logs.

1. In the Entra admin center, navigate to Identity > Monitoring & health > Sign-in logs.
2. Click on Add filters and select Continuous access evaluation.
3. Set the filter to Yes.

When you click on a specific log entry where a session was revoked, the Conditional Access tab will display the exact reason for the token rejection. For example, if you disable a user’s account in Active Directory and Azure AD Connect syncs the change, you will see a CAE event terminating their active Outlook session within seconds.

Step 4: Client Application Compatibility

It is crucial to understand that CAE relies on the client application understanding the revocation signal. If a legacy application (e.g., a custom Python script using basic MSAL) does not support CAE, it will not understand the re-authentication challenge sent by the resource provider.

To ensure total security, Microsoft recommends blocking legacy authentication entirely, forcing all users to modern applications (like the native Office desktop apps, Edge/Chrome, and the Outlook mobile app), which natively support CAE claim challenges.

Conclusion

Continuous Access Evaluation fundamentally transforms Microsoft Entra ID from a static token issuer into a dynamic, real-time security enforcer. By implementing CAE, enterprise security teams can close the dangerous vulnerability window of active JWT lifespans, ensuring that compromised accounts, stolen devices, and network anomalies result in immediate, zero-latency session termination.