Continuous Access Evaluation

Continuous Access Evaluation (CAE) is the Microsoft Entra ID feature that revokes active access tokens in near real time when risk signals change. Without CAE, OAuth access tokens are valid for their lifetime (typically 60–90 minutes), so a user who's disabled or has their password reset can still access resources until the token expires. With CAE, services like Exchange Online, SharePoint Online, and Microsoft Graph re-validate tokens against Entra ID in real time and reject them when account state, location, or risk has changed. CAE applies automatically to supported workloads in supported clients; no admin configuration required for the basic capability.

Two mechanisms, not one

CAE actually combines two distinct mechanisms. Critical event evaluation reacts to a defined list of account-state changes — account disabled, password changed or reset, user location changing in a way that violates a Conditional Access location policy, and a small set of other high-signal events — and revokes the token essentially immediately, typically within a few minutes. Claims challenge is the complementary mechanism: a CAE-aware resource provider (Exchange, SharePoint, Graph) that receives a request it isn't fully satisfied with — for example, the client is now on a network outside a policy's allowed range — can challenge the client to fetch a fresh token that satisfies the current Conditional Access state, rather than accepting the stale one at face value.

Worked example

An employee is terminated at 2pm. Their manager disables the Entra ID account through HR offboarding at 2:05pm. Before CAE, the employee's already-issued Outlook and Teams access tokens would remain valid until they naturally expired — potentially still working for up to an hour after the account was disabled, since the client caches the token and has no reason to ask Entra ID again until it does expire. With CAE, Exchange Online and Microsoft Graph detect the critical event (account disabled) and reject the employee's existing tokens on their next request, typically within minutes rather than up to an hour — cutting off mail, calendar, and file access from that already-issued token almost immediately, well before the token's nominal expiry.

Why it matters for the token-theft problem

CAE is a meaningful part of the defence against token theft attacks (an attacker who has phished or otherwise obtained a valid access token, without needing the user's password at all): even a stolen token becomes far less useful once the legitimate account owner's session state changes, because CAE-aware services will re-validate rather than trust the token for its full nominal lifetime. It's most effective paired with Continuous Access Evaluation for Conditional Access location (revoking a token the moment its sign-in location leaves an allowed named location) and token protection, which binds a token to the device it was issued on so a copied token can't be replayed elsewhere in the first place.

Scope and limitations

CAE support depends on both the resource (Exchange Online, SharePoint Online, and Microsoft Graph are CAE-aware; not every first- and third-party API is) and the client (modern Microsoft 365 clients and recent browser sessions support it; older or non-Microsoft clients may fall back to the old token-lifetime behaviour). Admins can't meaningfully "turn CAE off" for supported workloads — it's a background protection, not a policy an admin authors — which is part of why it's worth knowing about even though there's rarely a setting to configure: it changes what "how fast does a disabled account actually lose access" means in incident-response planning.