Continuous access evaluation
Continuous access evaluation (CAE), in Microsoft Entra ID, lets supported resources respond to specified identity events and policy conditions during an access-token lifetime, rather than relying only on token expiration.
Why an unexpired token can stop working
An access token usually has an expiry time, but an account may be disabled before that time arrives. CAE gives supported resources a way to react to that change during the token’s lifetime.
In Microsoft’s revocation flow, Entra sends the resource an event after an administrator revokes the user’s refresh tokens. When the client next presents its access token, the resource can reject it and return a claims challenge. The compatible client then goes back to Entra for reevaluation instead of continuing to use its cached token.
What “continuous” covers
Microsoft describes critical-event handling as near real time, with propagation delays of up to 15 minutes possible. Support varies by client, resource, and event; the name does not mean every application checks every policy change immediately.
Check Microsoft’s support tables for the combination you use. Its network-location enforcement also has conditions and exceptions worth reviewing before relying on it to restrict access.
CAE and session revocation are related, but they are not interchangeable. An application can issue its own session cookie, which Entra cannot directly revoke. During containment, establish whether continued access comes from a resource accepting an access token or an application accepting its own session. That determines which owner needs to act.