Continuous access evaluation
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit c31ef71 · +2 −2 lines · also on GitHub
⋯ 205 unchanged lines
206206
207207
### Supported location policies
208208
209
−CAE only has insight into [IP-based named locations](~/identity/conditional-access/location-condition.md#ipv4-and-ipv6-address-ranges). CAE doesn't have insight into other location conditions like [MFA trusted IPs](~/identity/authentication/howto-mfa-mfasettings.md#trusted-ips) or country/region-based locations. When a user comes from an MFA trusted IP, trusted location that includes MFA Trusted IPs, or country/region location, CAE won't be enforced after that user moves to a different location. In those cases, Microsoft Entra issues a one-hour access token without instant IP enforcement check.
209
+CAE only has insight into [IP-based named locations](concept-assignment-network.md#ipv4-and-ipv6-address-ranges). CAE doesn't have insight into other location conditions like [MFA trusted IPs](concept-assignment-network.md#multifactor-authentication-trusted-ips) or country/region-based locations. When a user comes from an MFA trusted IP, trusted location that includes MFA Trusted IPs, or country/region location, CAE won't be enforced after that user moves to a different location. In those cases, Microsoft Entra issues a one-hour access token without instant IP enforcement check.
210210
211211
> [!IMPORTANT]
212
−> If you want your location policies to be enforced in real time by continuous access evaluation, use only the [IP based Conditional Access location condition](~/identity/conditional-access/location-condition.md) and configure all IP addresses, **including both IPv4 and IPv6**, that can be seen by your identity provider and resources provider. Do not use country/region location conditions or the trusted ips feature that is available in Microsoft Entra multifactor authentication's service settings page.
212
+> If you want your location policies to be enforced in real time by continuous access evaluation, use only the [IP based Conditional Access location condition](concept-assignment-network.md#ipv4-and-ipv6-address-ranges) and configure all IP addresses, **including both IPv4 and IPv6**, that can be seen by your identity provider and resources provider. Do not use country/region location conditions or the trusted ips feature that is available in Microsoft Entra multifactor authentication's service settings page.
213213
214214
### Named location limitations
215215
⋯ 46 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:06 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.