Continuous access evaluation

This page's changes and edits · All guidance changes

Microsoft's edit · 22 Jul 2025 17:50 UTC

Freshness updates July2

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 4ae1b7e · +12 ~~−11~~ lines · also on GitHub

11 ---

22 title: Continuous access evaluation in Microsoft Entra

3 −description: Responding to changes in user state faster with continuous access evaluation in Microsoft Entra

4 −

3 +description: Learn how continuous access evaluation in Microsoft Entra enhances security by responding to user state changes in near real time.

54 ms.service: entra-id

65 ms.subservice: conditional-access

76 ms.topic: conceptual

8 −ms.date: 03/14/2024

9 −

7 +ms.date: 07/22/2025

108 ms.author: joflore

119 author: MicrosoftGuyJFlo

1210 manager: femila

1311 ms.reviewer: vmahtani

14 −ms.custom: has-adal-ref

15 −

12 +ms.custom:

13 + - has-adal-ref

14 + - ai-gen-docs-bap

15 + - ai-gen-description

16 + - ai-seo-date:07/22/2025

1617 ---

1718 # Continuous access evaluation

1819

⋯ 39 unchanged lines

5859 This process enables the scenario where users lose access to files, email, calendar, or tasks from Microsoft 365 client apps or SharePoint Online immediately after network location changes.

5960

6061 > [!NOTE]

61 −> Not all client app and resource provider combinations are supported. See the following tables. The first column of this table refers to web applications launched via web browser (that is, PowerPoint launched in web browser) while the remaining four columns refer to native applications running on each platform described. Additionally, references to "Office" encompass Word, Excel, and PowerPoint.

62 +> Not all client app and resource provider combinations are supported. See the following tables. The first column of this table refers to web applications launched via web browser (that is, PowerPoint launched in web browser). The remaining four columns refer to native applications running on each platform described. Additionally, references to "Office" encompass Word, Excel, and PowerPoint.

6263

6465 | :--- | :---: | :---: | :---: | :---: | :---: |

⋯ 18 unchanged lines

8384 > \* Token lifetimes for Office web apps are reduced to 1 hour when a Conditional Access policy is set.

8485

8586 > [!NOTE]

86 −> Teams is made up of multiple services and among these the calls and chat services don't adhere to IP-based Conditional Access policies.

87 +> Teams is made up of multiple services, the calls and chat services don't adhere to IP-based Conditional Access policies.

8788

8889 Continuous access evaluation is also available in Azure Government tenants (GCC High and DOD) for Exchange Online.

8990

⋯ 1 unchanged line

9192

9293 ### Client-side claim challenge

9394

94 −Before continuous access evaluation, clients would replay the access token from its cache as long as it wasn't expired. With CAE, we introduce a new case where a resource provider can reject a token when it isn't expired. To inform clients to bypass their cache even though the cached tokens haven't expired, we introduce a mechanism called **claim challenge** to indicate that the token was rejected and a new access token needs to be issued by Microsoft Entra. CAE requires a client update to understand claim challenge. The latest versions of the following applications support claim challenge:

95 +Before continuous access evaluation, clients would replay the access token from its cache as long as it wasn't expired. With CAE, we introduce a new case where a resource provider can reject a token when it isn't expired. To inform clients to bypass their cache even though the cached tokens aren't expired, we introduce a mechanism called **claim challenge** to indicate that the token was rejected and a new access token needs to be issued by Microsoft Entra. CAE requires a client update to understand claim challenge. The latest versions of the following applications support claim challenge:

9596

9697 | | Web | Win32 | iOS | Android | Mac |

9798 | :--- | :---: | :---: | :---: | :---: | :---: |

⋯ 69 unchanged lines

167168

168169 ### Group membership and Policy update effective time

169170

170 −Changes made to Conditional Access policies and group membership made by administrators could take up to one day to be effective. The delay is from replication between Microsoft Entra and resource providers like Exchange Online and SharePoint Online. Some optimization has been done for policy updates, which reduce the delay to two hours. However, it doesn't cover all the scenarios yet.

171 +Changes made to Conditional Access policies and group membership made by administrators could take up to one day to be effective. The delay is from replication between Microsoft Entra and resource providers like Exchange Online and SharePoint Online. Some optimization is done for policy updates, which reduce the delay to two hours. However, it doesn't cover all the scenarios yet.

171172

172173 When Conditional Access policy or group membership changes need to be applied to certain users immediately, you have two options.

173174

⋯ 35 unchanged lines

209210 CAE only has insight into [IP-based named locations](concept-assignment-network.md#ipv4-and-ipv6-address-ranges). CAE doesn't have insight into other location conditions like [MFA trusted IPs](concept-assignment-network.md#multifactor-authentication-trusted-ips) or country/region-based locations. When a user comes from an MFA trusted IP, trusted location that includes MFA Trusted IPs, or country/region location, CAE won't be enforced after that user moves to a different location. In those cases, Microsoft Entra issues a one-hour access token without instant IP enforcement check.

210211

211212 > [!IMPORTANT]

212 −> If you want your location policies to be enforced in real time by continuous access evaluation, use only the [IP based Conditional Access location condition](concept-assignment-network.md#ipv4-and-ipv6-address-ranges) and configure all IP addresses, **including both IPv4 and IPv6**, that can be seen by your identity provider and resources provider. Do not use country/region location conditions or the trusted ips feature that is available in Microsoft Entra multifactor authentication's service settings page.

213 +> If you want your location policies to be enforced in real time by continuous access evaluation, use only the [IP based Conditional Access location condition](concept-assignment-network.md#ipv4-and-ipv6-address-ranges) and configure all IP addresses, **including both IPv4 and IPv6**, that can be seen by your identity provider and resources provider. Don't use country/region location conditions or the trusted ips feature that is available in Microsoft Entra multifactor authentication's service settings page.

213214

214215 ### Named location limitations

215216

⋯ 46 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:06 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.