ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 22:55 UTC Customize Public modeDiscuss ChangeIntel on Discord

Continuous access evaluation

This page's changes and edits · All guidance changes

Microsoft's edit ·

[Global Secure Access] CAE Location update from PG

Microsoft's commit message in MicrosoftDocs/entra-docs · commit ec95adc · +40 −37 lines · also on GitHub

11 ---
2 −title: Continuous access evaluation in Microsoft Entra ID
3 −description: Responding to changes in user state faster with continuous access evaluation in Microsoft Entra ID
2 +title: Continuous access evaluation in Microsoft Entra
3 +description: Responding to changes in user state faster with continuous access evaluation in Microsoft Entra
44
55 ms.service: entra-id
66 ms.subservice: conditional-access
77 ms.topic: conceptual
8 −ms.date: 07/27/2023
8 +ms.date: 03/14/2024
99
1010 ms.author: joflore
1111 author: MicrosoftGuyJFlo
⋯ 4 unchanged lines
1616 ---
1717 # Continuous access evaluation
1818
19 −Token expiration and refresh are a standard mechanism in the industry. When a client application like Outlook connects to a service like Exchange Online, the API requests are authorized using OAuth 2.0 access tokens. By default, access tokens are valid for one hour, when they expire the client is redirected to Microsoft Entra ID to refresh them. That refresh period provides an opportunity to reevaluate policies for user access. For example: we might choose not to refresh the token because of a Conditional Access policy, or because the user has been disabled in the directory.
19 +Token expiration and refresh are a standard mechanism in the industry. When a client application like Outlook connects to a service like Exchange Online, the API requests are authorized using OAuth 2.0 access tokens. By default, access tokens are valid for one hour, when they expire the client is redirected to Microsoft Entra to refresh them. That refresh period provides an opportunity to reevaluate policies for user access. For example: we might choose not to refresh the token because of a Conditional Access policy, or because the user is disabled in the directory.
2020
21 −Customers have expressed concerns about the lag between when conditions change for a user, and when policy changes are enforced. Microsoft Entra ID has experimented with the "blunt object" approach of reduced token lifetimes but found they can degrade user experiences and reliability without eliminating risks.
21 +Customers express concerns about the lag between when conditions change for a user, and when policy changes are enforced. Microsoft experimented with the "blunt object" approach of reduced token lifetimes but found they degrade user experiences and reliability without eliminating risks.
2222
23 −Timely response to policy violations or security issues really requires a "conversation" between the token issuer (Microsoft Entra ID), and the relying party (enlightened app). This two-way conversation gives us two important capabilities. The relying party can see when properties change, like network location, and tell the token issuer. It also gives the token issuer a way to tell the relying party to stop respecting tokens for a given user because of account compromise, disablement, or other concerns. The mechanism for this conversation is continuous access evaluation (CAE), an industry standard based on [Open ID Continuous Access Evaluation Profile (CAEP)](https://openid.net/specs/openid-caep-specification-1_0-01.html). The goal for critical event evaluation is for response to be near real time, but latency of up to 15 minutes may be observed because of event propagation time; however, IP locations policy enforcement is instant.
23 +Timely response to policy violations or security issues really requires a "conversation" between the token issuer Microsoft Entra, and the relying party (enlightened app). This two-way conversation gives us two important capabilities. The relying party can see when properties change, like network location, and tell the token issuer. It also gives the token issuer a way to tell the relying party to stop respecting tokens for a given user because of account compromise, disablement, or other concerns. The mechanism for this conversation is continuous access evaluation (CAE), an industry standard based on [Open ID Continuous Access Evaluation Profile (CAEP)](https://openid.net/specs/openid-caep-specification-1_0-01.html). The goal for critical event evaluation is for response to be near real time, but latency of up to 15 minutes might be observed because of event propagation time; however, IP locations policy enforcement is instant.
2424
2525 The initial implementation of continuous access evaluation focuses on Exchange, Teams, and SharePoint Online.
2626
⋯ 28 unchanged lines
5555
5656 Exchange Online, SharePoint Online, Teams, and MS Graph can synchronize key Conditional Access policies for evaluation within the service itself.
5757
58 −This process enables the scenario where users lose access to organizational files, email, calendar, or tasks from Microsoft 365 client apps or SharePoint Online immediately after network location changes.
58 +This process enables the scenario where users lose access to files, email, calendar, or tasks from Microsoft 365 client apps or SharePoint Online immediately after network location changes.
5959
6060 > [!NOTE]
6161 > Not all client app and resource provider combinations are supported. See the following tables. The first column of this table refers to web applications launched via web browser (i.e. PowerPoint launched in web browser) while the remaining four columns refer to native applications running on each platform described. Additionally, references to "Office" encompass Word, Excel, and PowerPoint.
⋯ 29 unchanged lines
9191
9292 ### Client-side claim challenge
9393
94 −Before continuous access evaluation, clients would replay the access token from its cache as long as it wasn't expired. With CAE, we introduce a new case where a resource provider can reject a token when it isn't expired. To inform clients to bypass their cache even though the cached tokens haven't expired, we introduce a mechanism called **claim challenge** to indicate that the token was rejected and a new access token need to be issued by Microsoft Entra ID. CAE requires a client update to understand claim challenge. The latest versions of the following applications support claim challenge:
94 +Before continuous access evaluation, clients would replay the access token from its cache as long as it wasn't expired. With CAE, we introduce a new case where a resource provider can reject a token when it isn't expired. To inform clients to bypass their cache even though the cached tokens haven't expired, we introduce a mechanism called **claim challenge** to indicate that the token was rejected and a new access token need to be issued by Microsoft Entra. CAE requires a client update to understand claim challenge. The latest versions of the following applications support claim challenge:
9595
9696 | | Web | Win32 | iOS | Android | Mac |
9797 | :--- | :---: | :---: | :---: | :---: | :---: |
⋯ 16 unchanged lines
114114
115115 ![User revocation event flow](./media/concept-continuous-access-evaluation/user-revocation-event-flow.png)
116116
117 −1. A CAE-capable client presents credentials or a refresh token to Microsoft Entra ID asking for an access token for some resource.
117 +1. A CAE-capable client presents credentials or a refresh token to Microsoft Entra asking for an access token for some resource.
118118 1. An access token is returned along with other artifacts to the client.
119 −1. An Administrator explicitly [revokes all refresh tokens for the user](/powershell/module/microsoft.graph.users.actions/revoke-mgusersigninsession), then a revocation event is sent to the resource provider from Microsoft Entra ID.
119 +1. An Administrator explicitly [revokes all refresh tokens for the user](/powershell/module/microsoft.graph.users.actions/revoke-mgusersigninsession), then a revocation event is sent to the resource provider from Microsoft Entra.
120120 1. An access token is presented to the resource provider. The resource provider evaluates the validity of the token and checks whether there's any revocation event for the user. The resource provider uses this information to decide to grant access to the resource or not.
121121 1. In this case, the resource provider denies access, and sends a 401+ claim challenge back to the client.
122 −1. The CAE-capable client understands the 401+ claim challenge. It bypasses the caches and goes back to step 1, sending its refresh token along with the claim challenge back to Microsoft Entra ID. Microsoft Entra ID then reevaluates all the conditions and prompt the user to reauthenticate in this case.
122 +1. The CAE-capable client understands the 401+ claim challenge. It bypasses the caches and goes back to step 1, sending its refresh token along with the claim challenge back to Microsoft Entra. Microsoft Entra then reevaluates all the conditions and prompts the user to reauthenticate in this case.
123123
124124 ### User condition change flow
125125
126 −In the following example, a Conditional Access Administrator has configured a location based Conditional Access policy to only allow access from specific IP ranges:
126 +In the following example, a Conditional Access Administrator configured a location based Conditional Access policy to only allow access from specific IP ranges:
127127
128128 ![User condition event flow](./media/concept-continuous-access-evaluation/user-condition-change-flow.png)
129129
130 −1. A CAE-capable client presents credentials or a refresh token to Microsoft Entra ID asking for an access token for some resource.
131 −1. Microsoft Entra ID evaluates all Conditional Access policies to see whether the user and client meet the conditions.
130 +1. A CAE-capable client presents credentials or a refresh token to Microsoft Entra asking for an access token for some resource.
131 +1. Microsoft Entra evaluates all Conditional Access policies to see whether the user and client meet the conditions.
132132 1. An access token is returned along with other artifacts to the client.
133133 1. User moves out of an allowed IP range.
134134 1. The client presents an access token to the resource provider from outside of an allowed IP range.
135 −1. The resource provider evaluates the validity of the token and checks the location policy synced from Microsoft Entra ID.
135 +1. The resource provider evaluates the validity of the token and checks the location policy synced from Microsoft Entra.
136136 1. In this case, the resource provider denies access, and sends a 401+ claim challenge back to the client. The client is challenged because it isn't coming from an allowed IP range.
137 −1. The CAE-capable client understands the 401+ claim challenge. It bypasses the caches and goes back to step 1, sending its refresh token along with the claim challenge back to Microsoft Entra ID. Microsoft Entra ID reevaluates all the conditions and denies access in this case.
137 +1. The CAE-capable client understands the 401+ claim challenge. It bypasses the caches and goes back to step 1, sending its refresh token along with the claim challenge back to Microsoft Entra. Microsoft Entra reevaluates all the conditions and denies access in this case.
138138
139139 ## Exception for IP address variations and how to turn off the exception
140140
141 −In step 8 above, when Microsoft Entra ID reevaluates the conditions, it denies access because the new location detected by Microsoft Entra ID is outside the allowed IP range. This isn't always the case. Due to [some complex network topologies](concept-continuous-access-evaluation.md#ip-address-variation-and-networks-with-ip-address-shared-or-unknown-egress-ips), the authentication request can arrive from an allowed egress IP address even after the access request received by the resource provider arrived from an IP address that isn't allowed. Under these conditions, Microsoft Entra ID interprets that the client continues to be in an allowed location and should be granted access. Therefore, Microsoft Entra ID issues a one-hour token that suspends IP address checks at the resource until token expiration. Microsoft Entra ID continues to enforce IP address checks.
141 +In step 8 above, when Microsoft Entra reevaluates the conditions, it denies access because the new location detected by Microsoft Entra is outside the allowed IP range. This isn't always the case. Due to [some complex network topologies](concept-continuous-access-evaluation.md#ip-address-variation-and-networks-with-ip-address-shared-or-unknown-egress-ips), the authentication request can arrive from an allowed egress IP address even after the access request received by the resource provider arrived from an IP address that isn't allowed. Under these conditions, Microsoft Entra interprets that the client continues to be in an allowed location and should be granted access. Therefore, Microsoft Entra issues a one-hour token that suspends IP address checks at the resource until token expiration. Microsoft Entra continues to enforce IP address checks.
142142
143 −Standard vs. Strict mode. The granting of access under this exception (that is, an allowed location detected between Microsoft Entra ID with a disallowed location detected by the resource provider) protects user productivity by maintaining access to critical resources. This is standard location enforcement. On the other hand, Administrators who operate under stable network topologies and wish remove this exception can use [Strict Location Enforcement (Public Preview)](concept-continuous-access-evaluation-strict-enforcement.md).
143 +If you're sending traffic to non-Microsoft 365 resources through Global Secure Access, resource providers aren't aware of the source IP address of the user as [source IP restoration](../../global-secure-access/how-to-source-ip-restoration.md) isn’t currently supported for these resources. In this case, if the user is in the trusted IP location (as seen by Microsoft Entra), Microsoft Entra issues a one-hour token that suspends IP address checks at the resource until token expiration. Microsoft Entra continues to enforce IP address checks correctly for these resources.
144144
145 +- **Standard location enforcement mode**: The granting of access under this exception (that is, an allowed location detected between Microsoft Entra with a disallowed location detected by the resource provider) protects user productivity by maintaining access to critical resources.
146 +- **Strict location enforcement mode**: Administrators who operate under stable network topologies and wish remove the standard mode exception can use [Strict Location Enforcement (Public Preview)](concept-continuous-access-evaluation-strict-enforcement.md).
147 +
145148 ## Enable or disable CAE
146149
147 −The CAE setting has been moved to under the Conditional Access blade. New CAE customers can access and toggle CAE directly when creating Conditional Access policies. However, some existing customers must go through migration before they can access CAE through Conditional Access.
150 +The CAE setting moved to Conditional Access. New CAE customers can access and toggle CAE directly when creating Conditional Access policies. However, some existing customers must go through migration before they can access CAE through Conditional Access.
148151
149152 #### Migration
150153
151 −Customers who have configured CAE settings under Security before have to migrate settings to a new Conditional Access policy.
154 +Customers who configured CAE settings under Security before must migrate settings to a new Conditional Access policy.
152155
153156 The following table describes the migration experience of each customer group based on previously configured CAE settings.
154157
⋯ 10 unchanged lines
165168
166169 ### Group membership and Policy update effective time
167170
168 −Changes made to Conditional Access policies and group membership made by administrators could take up to one day to be effective. The delay is from replication between Microsoft Entra ID and resource providers like Exchange Online and SharePoint Online. Some optimization has been done for policy updates, which reduce the delay to two hours. However, it doesn't cover all the scenarios yet.
171 +Changes made to Conditional Access policies and group membership made by administrators could take up to one day to be effective. The delay is from replication between Microsoft Entra and resource providers like Exchange Online and SharePoint Online. Some optimization has been done for policy updates, which reduce the delay to two hours. However, it doesn't cover all the scenarios yet.
169172
170173 When Conditional Access policy or group membership changes need to be applied to certain users immediately, you have two options.
171174
⋯ 2 unchanged lines
174177
175178 ### IP address variation and networks with IP address shared or unknown egress IPs
176179
177 −Modern networks often optimize connectivity and network paths for applications differently. This optimization frequently causes variations of the routing and source IP addresses of connections, as seen by your identity provider and resource providers. You may observe this split path or IP address variation in multiple network topologies, including, but not limited to:
180 +Modern networks often optimize connectivity and network paths for applications differently. This optimization frequently causes variations of the routing and source IP addresses of connections, as seen by your identity provider and resource providers. You might observe this split path or IP address variation in multiple network topologies, including, but not limited to:
178181
179182 - On-premises and cloud-based proxies.
180183 - Virtual private network (VPN) implementations, like [split tunneling](/microsoft-365/enterprise/microsoft-365-vpn-implement-split-tunnel).
⋯ 3 unchanged lines
184187 - Networks that support IPv6 clients.
185188 - Other topologies, which handle application or resource traffic differently from traffic to the identity provider.
186189
187 −In addition to IP variations, customers also may employ network solutions and services that:
190 +In addition to IP variations, customers also might employ network solutions and services that:
188191
189 −- Use IP addresses that may be shared with other customers. For example, cloud-based proxy services where egress IP addresses are shared between customers.
192 +- Use IP addresses that might be shared with other customers. For example, cloud-based proxy services where egress IP addresses are shared between customers.
190193 - Use easily varied or undefinable IP addresses. For example, topologies where there are large, dynamic sets of egress IP addresses used, like large enterprise scenarios or [split VPN](/microsoft-365/enterprise/microsoft-365-vpn-implement-split-tunnel) and local egress network traffic.
191194
192 −Networks where egress IP addresses may change frequently or are shared may affect Microsoft Entra Conditional Access and Continues Access Evaluation (CAE). This variability can affect how these features work and their recommended configurations. Split Tunneling may also cause unexpected blocks when an environment is configured using [Split Tunneling VPN Best Practices](/microsoft-365/enterprise/microsoft-365-vpn-implement-split-tunnel). Routing [Optimized IPs](/microsoft-365/enterprise/microsoft-365-vpn-implement-split-tunnel#optimize-ip-address-ranges) through a Trusted IP/VPN may be required to prevent blocks related to *insufficient_claims* or *Instant IP Enforcement check failed*.
195 +Networks where egress IP addresses might change frequently or are shared might affect Microsoft Entra Conditional Access and Continues Access Evaluation (CAE). This variability can affect how these features work and their recommended configurations. Split Tunneling might also cause unexpected blocks when an environment is configured using [Split Tunneling VPN Best Practices](/microsoft-365/enterprise/microsoft-365-vpn-implement-split-tunnel). Routing [Optimized IPs](/microsoft-365/enterprise/microsoft-365-vpn-implement-split-tunnel#optimize-ip-address-ranges) through a Trusted IP/VPN might be required to prevent blocks related to *insufficient_claims* or *Instant IP Enforcement check failed*.
193196
194197
195 −The following table summarizes Conditional Access and CAE feature behaviors and recommendations for different types of network deployments:
198 +The following table summarizes Conditional Access and CAE feature behaviors and recommendations for different types of network deployments and resource providers (RP):
196199
197 −| Network Type | Example | IPs seen by Microsoft Entra ID | IPs seen by RP | Applicable Conditional Access Configuration (Trusted Named Location) | CAE enforcement | CAE access token | Recommendations |
200 +| Network Type | Example | IPs seen by Microsoft Entra | IPs seen by RP | Applicable Conditional Access Configuration (Trusted Named Location) | CAE enforcement | CAE access token | Recommendations |
198201 |---|---|---|---|---|---|---|---|
199 −| 1. Egress IPs are dedicated and enumerable for both Microsoft Entra ID and all RPs traffic | All to network traffic to Microsoft Entra ID and RPs egresses through 1.1.1.1 and/or 2.2.2.2 | 1.1.1.1 | 2.2.2.2 | 1.1.1.1 <br> 2.2.2.2 | Critical Events <br> IP location Changes | Long lived – up to 28 hours | If Conditional Access Named Locations are defined, ensure that they contain all possible egress IPs (seen by Microsoft Entra ID and all RPs) |
200 −| 2. Egress IPs are dedicated and enumerable for Microsoft Entra ID, but not for RPs traffic | Network traffic to Microsoft Entra egresses through 1.1.1.1. RP traffic egresses through x.x.x.x | 1.1.1.1 | x.x.x.x | 1.1.1.1 | Critical Events | Default access token lifetime – 1 hour | Don't add non dedicated or nonenumerable egress IPs (x.x.x.x) into Trusted Named Location Conditional Access rules as it can weaken security |
201 −| 3. Egress IPs are non-dedicated/shared or not enumerable for both Microsoft Entra ID and RPs traffic | Network traffic to Microsoft Entra egresses through y.y.y.y. RP traffic egresses through x.x.x.x | y.y.y.y | x.x.x.x | N/A -no IP Conditional Access policies/Trusted Locations configured | Critical Events | Long lived – up to 28 hours | Don't add non dedicated or nonenumerable egress IPs (x.x.x.x/y.y.y.y) into Trusted Named Location Conditional Access rules as it can weaken security |
202 +| 1. Egress IPs are dedicated and enumerable for both Microsoft Entra and all RP traffic | All to network traffic to Microsoft Entra and RPs egresses through 1.1.1.1 and/or 2.2.2.2 | 1.1.1.1 | 2.2.2.2 | 1.1.1.1 <br> 2.2.2.2 | Critical Events <br> IP location Changes | Long lived – up to 28 hours | If Conditional Access Named Locations are defined, ensure that they contain all possible egress IPs (seen by Microsoft Entra and all RP) |
203 +| 2. Egress IPs are dedicated and enumerable for Microsoft Entra, but not for RP traffic | Network traffic to Microsoft Entra egresses through 1.1.1.1. RP traffic egresses through x.x.x.x | 1.1.1.1 | x.x.x.x | 1.1.1.1 | Critical Events | Default access token lifetime – 1 hour | Don't add non dedicated or nonenumerable egress IPs (x.x.x.x) into Trusted Named Location Conditional Access rules as it can weaken security |
204 +| 3. Egress IPs are non-dedicated/shared or not enumerable for both Microsoft Entra and RP traffic | Network traffic to Microsoft Entra egresses through y.y.y.y. RP traffic egresses through x.x.x.x | y.y.y.y | x.x.x.x | N/A -no IP Conditional Access policies/Trusted Locations are configured | Critical Events | Long lived – up to 28 hours | Don't add non dedicated or nonenumerable egress IPs (x.x.x.x/y.y.y.y) into Trusted Named Location Conditional Access rules as it can weaken security |
202205
203 −Networks and network services used by clients connecting to identity and resource providers continue to evolve and change in response to modern trends. These changes may affect Conditional Access and CAE configurations that rely on the underlying IP addresses. When deciding on these configurations, factor in future changes in technology and upkeep of the defined list of addresses in your plan.
206 +Networks and network services used by clients connecting to identity and resource providers continue to evolve and change in response to modern trends. These changes might affect Conditional Access and CAE configurations that rely on the underlying IP addresses. When deciding on these configurations, factor in future changes in technology and upkeep of the defined list of addresses in your plan.
204207
205208 ### Supported location policies
206209
207 −CAE only has insight into [IP-based named locations](~/identity/conditional-access/location-condition.md#ipv4-and-ipv6-address-ranges). CAE doesn't have insight into other location conditions like [MFA trusted IPs](~/identity/authentication/howto-mfa-mfasettings.md#trusted-ips) or country/region-based locations. When a user comes from an MFA trusted IP, trusted location that includes MFA Trusted IPs, or country/region location, CAE won't be enforced after that user moves to a different location. In those cases, Microsoft Entra ID issues a one-hour access token without instant IP enforcement check.
210 +CAE only has insight into [IP-based named locations](~/identity/conditional-access/location-condition.md#ipv4-and-ipv6-address-ranges). CAE doesn't have insight into other location conditions like [MFA trusted IPs](~/identity/authentication/howto-mfa-mfasettings.md#trusted-ips) or country/region-based locations. When a user comes from an MFA trusted IP, trusted location that includes MFA Trusted IPs, or country/region location, CAE won't be enforced after that user moves to a different location. In those cases, Microsoft Entra issues a one-hour access token without instant IP enforcement check.
208211
209212 > [!IMPORTANT]
210213 > If you want your location policies to be enforced in real time by continuous access evaluation, use only the [IP based Conditional Access location condition](~/identity/conditional-access/location-condition.md) and configure all IP addresses, **including both IPv4 and IPv6**, that can be seen by your identity provider and resources provider. Do not use country/region location conditions or the trusted ips feature that is available in Microsoft Entra multifactor authentication's service settings page.
211214
212215 ### Named location limitations
213216
214 −When the sum of all IP ranges specified in location policies exceeds 5,000, user change location flow isn't enforced by CAE in real time. In this case, Microsoft Entra ID issues a one-hour CAE token. CAE continues enforcing [all other events and policies](#critical-event-evaluation) besides client location change events. With this change, you still maintain stronger security posture compared to traditional one-hour tokens, since [other events](#critical-event-evaluation) are still evaluated in near real time.
217 +When the sum of all IP ranges specified in location policies exceeds 5,000, CAE can't enforce user change location flow in real time. In this case, Microsoft Entra issues a one-hour CAE token. CAE continues enforcing [all other events and policies](#critical-event-evaluation) besides client location change events. With this change, you still maintain stronger security posture compared to traditional one-hour tokens, since [other events](#critical-event-evaluation) are still evaluated in near real time.
215218
216219 ### Office and Web Account Manager settings
217220
218221 | Office update channel | DisableADALatopWAMOverride | DisableAADWAM |
219222 | --- | --- | --- |
220 −| Semi-Annual Enterprise Channel | If set to enabled or 1, CAE won't be supported. | If set to enabled or 1, CAE won't be supported. |
223 +| Semi-Annual Enterprise Channel | If set to enabled or 1, CAE isn't supported. | If set to enabled or 1, CAE isn't supported. |
221224 | Current Channel <br> or <br> Monthly Enterprise Channel | CAE is supported whatever the setting | CAE is supported whatever the setting |
222225
223226 For an explanation of the office update channels, see [Overview of update channels for Microsoft 365 Apps](/deployoffice/updates/overview-update-channels). The recommendation is that organizations don't disable Web Account Manager (WAM).
224227
225228 ### Coauthoring in Office apps
226229
227 −When multiple users are collaborating on a document at the same time, their access to the document may not be immediately revoked by CAE based on policy change events. In this case, the user loses access completely after:
230 +When multiple users are collaborating on a document at the same time, CAE might not revoke their access to the document immediately based on policy change events. In this case, the user loses access completely after:
228231
229232 - Closing the document
230233 - Closing the Office app
231234 - After 1 hour when a Conditional Access IP policy is set
232235
233 −To further reduce this time, a SharePoint Administrator can reduce the maximum lifetime of coauthoring sessions for documents stored in SharePoint Online and OneDrive for Business, by [configuring a network location policy in SharePoint Online](/sharepoint/control-access-based-on-network-location). Once this configuration is changed, the maximum lifetime of coauthoring sessions is reduced to 15 minutes, and can be adjusted further using the SharePoint Online PowerShell command [Set-SPOTenant –IPAddressWACTokenLifetime](/powershell/module/sharepoint-online/set-spotenant).
236 +To further reduce this time, a SharePoint Administrator can reduce the maximum lifetime of coauthoring sessions for documents stored in SharePoint Online and Microsoft OneDrive, by [configuring a network location policy](/sharepoint/control-access-based-on-network-location). Once this configuration is changed, the maximum lifetime of coauthoring sessions is reduced to 15 minutes, and can be adjusted further using the SharePoint Online PowerShell command [Set-SPOTenant –IPAddressWACTokenLifetime](/powershell/module/sharepoint-online/set-spotenant).
234237
235238 ### Enable after a user is disabled
236239
⋯ 14 unchanged lines
251254
252255 Sign-in Frequency is honored with or without CAE.
253256
254 −## Next steps
257 +## Related content
255258
256259 - [How to use Continuous Access Evaluation enabled APIs in your applications](~/identity-platform/app-resilience-continuous-access-evaluation.md)
257260 - [Claims challenges, claims requests, and client capabilities](~/identity-platform/claims-challenge.md)
⋯ 2 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 22:55 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.