PA-07: Enable Continuous Access Evaluation

PA-07 is a security control that standard oauth tokens are valid for 60-90 minutes. if an admin is compromised and you disable their account, the attacker still has that time window. cae revokes access within seconds of critical events. It requires that continuous access evaluation (cae) is enabled for all supported applications and critical event evaluation (user disabled, password changed) triggers immediate revocation, strict location enforcement is enabled for admin access.

Standard OAuth tokens are valid for 60-90 minutes. If an admin is compromised and you disable their account, the attacker still has that time window. CAE revokes access within seconds of critical events.

PA-07 requires manual implementation. CAE is enabled by default for supported apps; requires verification

This control requires Azure AD Premium P1 (included in Microsoft 365 E3) or higher.

PA-07 is included in the Maximum Security baseline (Level 3). This level is designed for high-security environments and regulated industries.

PA-07 is rated critical because failure to implement this control significantly increases the risk of security incidents. Standard OAuth tokens are valid for 60-90 minutes. If an admin is compromised and you disable their account, the attacker still has that time window. CAE revokes access within seconds of critical events.