Continuous Access Evaluation
CAEReal-time policy enforcement that can revoke access within seconds when critical security events occur.
What is Continuous Access Evaluation?
Traditional OAuth access tokens are valid for their full lifetime (typically 60-90 minutes) even after the user is disabled or their location changes. CAE enables near-instantaneous token revocation when critical events occur—user disabled, password changed, high risk detected, or location policy violated. This closes the window of opportunity for attackers using stolen tokens.
In Microsoft 365
CAE is enabled by default in Azure AD for supported applications (Exchange, SharePoint, Teams, Graph). Strict location enforcement can be configured in Conditional Access to require CAE for location-based policies. Critical event evaluation triggers on user disablement and password changes.
Examples
- 1Disabled user loses access within seconds instead of waiting for token expiry
- 2Location change triggers re-authentication
- 3Risk detection immediately blocks access
Related TrueConfig Controls
These controls help implement and verify continuous access evaluation in your Microsoft 365 environment.