What is Continuous Access Evaluation (CAE)?

The Problem CAE Solves

Traditional OAuth token lifetimes run about an hour, and refresh tokens considerably longer. Once a token is issued, the identity provider trusts it until expiry. If circumstances change — the user is disabled, the password is reset, the session moves to a hostile network, the account is flagged as high risk — the existing token keeps working until it expires on schedule.

That window is what an attacker with a stolen token uses. An organization can detect a compromise, disable the account, and reset the password, and the attacker's session continues functioning until the token times out.

How CAE Works

CAE establishes a communication channel between the identity provider and the resource provider so that critical events propagate immediately rather than waiting for token expiry.

Events that trigger near-immediate revocation:

• User account deleted or disabled
• Password changed or reset
• Administrator explicitly revokes refresh tokens
• Account flagged as high risk by identity protection
• Multi-factor authentication enabled or method changed

Additionally, strict location enforcement re-evaluates the session when the client IP changes in a way that violates Conditional Access policy. A token issued to a session in one country and then presented from another is challenged rather than accepted.

The practical effect is that revocation latency drops from up to an hour to roughly seconds.

What CAE Does and Does Not Do

It does close the window between detecting a compromise and actually terminating the attacker's access. In an incident, that difference is material: the containment action becomes effective immediately rather than after a delay during which the attacker continues operating.

It does catch a class of token replay where the attacker's network context differs from the legitimate session, through strict location enforcement.

It does not prevent the initial token theft. If an attacker captures a token through an AiTM proxy and uses it from a network context that satisfies policy, CAE will not intervene. Prevention is phishing-resistant MFA; CAE is containment.

It does not work uniformly across all applications. CAE requires support on both sides. Microsoft 365 services support it well; third-party and legacy applications vary. Coverage should be verified rather than assumed.

Enabling It

In Microsoft Entra ID, CAE is enabled through Conditional Access policy. Most tenants have it available and many have it partially configured by default. The configuration decisions that matter:

• Enable CAE across all applications that support it
• Turn on strict location enforcement, understanding that it may affect users behind rotating IP infrastructure
• Verify which applications in the environment do not support CAE and treat those as a residual risk requiring compensating controls
• Confirm that identity protection risk signals are actually feeding the revocation triggers

Okta, Ping, and other providers offer comparable session-revalidation capabilities under different names.

Why It Belongs in Diligence

CAE status is a specific, checkable configuration question with a clear answer. A target that has it enabled has taken a concrete step toward limiting session-theft exposure. A target that has not is carrying an unnecessary revocation delay in every incident it will ever have.

It is also inexpensive to remediate — a Conditional Access policy change rather than a project — which makes it a good example of a finding that produces measurable risk reduction for close to nothing.

Related Reading

• What is Session Token Theft?
• What is Phishing-Resistant MFA?
• What is Zero Trust Security?
• What is Identity Governance?
• What is an Adversary-in-the-Middle Attack?

The Containment Gap

Consider the Apollo Global Management timeline. Attackers held access from July 6 to July 10, 2026. Suppose the compromise had been detected on day one and the affected accounts disabled immediately.

Without CAE, the attacker's existing session tokens would have continued working until expiry — up to an hour of continued access after the containment action, during which an attacker who knows they have been detected will move quickly to establish persistence through OAuth grants, device registration, or mailbox rules.

With CAE, the revocation propagates in seconds. That difference determines whether the containment action actually contained anything. Full account: Apollo Global Management 2026.