You disabled the account at 09:00. Without CAE, their Outlook kept working until the token expired.
Access tokens are valid for one hour by default, and disabling an account does not reach into a session already holding one. Continuous access evaluation closes that window by letting Exchange, SharePoint and Teams subscribe to critical Entra events and stop honouring tokens in near real time.
- 5 eventsCritical events evaluated in near real time
- 15 minutesMaximum observed propagation latency
- InstantIP location policy enforcement
- Any tenantCritical event evaluation needs no CA policy
Eight things to understand before you rely on it.
Critical event evaluation, available in any tenant
Enabling services subscribe to critical Entra events and enforce them near real time. Microsoft is explicit that critical event evaluation does not rely on Conditional Access policies, so it is available in any tenant. That is the half of CAE most organisations already benefit from without having configured anything.
The five events that are evaluated
A user account is deleted or disabled, a password is changed or reset, multifactor authentication is enabled for the user, an administrator explicitly revokes all refresh tokens, and high user risk is detected by Entra ID Protection. That list is finite, and knowing it is finite is the point.
How fast near real time actually is
The goal is near real time, and latency of up to 15 minutes might be observed because of event propagation time. IP location policy enforcement, by contrast, is instant. Those are two different numbers and quoting the wrong one in an incident runbook sets the wrong expectation.
Conditional Access policy evaluation inside the service
Exchange Online, SharePoint Online, Teams and Microsoft Graph can synchronise key Conditional Access policies for evaluation within the service itself. This is what allows access to stop immediately after a network location change rather than at the next token refresh.
Token lifetime becomes long lived on purpose
In CAE-aware sessions the token lifetime increases to long lived, up to 28 hours, because revocation is driven by events rather than by expiry. The configurable token lifetime policy is not honoured for CAE-aware clients. Without CAE-capable clients the default access token lifetime remains one hour.
Only IP-based named locations are visible to CAE
CAE has insight into IP-based named locations only. It does not have insight into MFA trusted IPs or country and region based locations. Where a user comes from one of those, CAE is not enforced after they move, and Entra issues a one-hour token without the instant IP enforcement check.
Guest accounts are not covered
Microsoft states directly that CAE does not support guest user accounts, and that revocation events and IP based Conditional Access policies are not enforced instantaneously for them. For UAE organisations working extensively with partners and contractors, that exclusion needs to be in the risk picture explicitly.
Client support determines whether any of it works
CAE relies on the client understanding a claim challenge, which means bypassing its token cache when a resource provider rejects an unexpired token. That requires up to date clients. On Semi-Annual Enterprise Channel, if DisableADALatopWAMOverride or DisableAADWAM is enabled, CAE is not supported at all.
Past 5,000 IP ranges in your location policies, real-time location enforcement stops.
Microsoft documents the threshold precisely: when the sum of all IP ranges specified in location policies exceeds 5,000, CAE cannot enforce the user location change flow in real time.
- In that state Entra issues a one-hour CAE token instead. CAE continues enforcing all other events and policies besides client location change events, so the position is still stronger than traditional one-hour tokens, but the instant location enforcement you were relying on is gone.
- This matters for organisations that have accumulated named locations over years, one branch or one supplier at a time. Nobody notices crossing 5,000 because nothing fails, the enforcement simply becomes less immediate. Counting your ranges is a ten minute check that most teams have never done.
- The related constraint is which location types CAE can see at all. It has insight into IP-based named locations only, not MFA trusted IPs and not country or region conditions. Microsoft is explicit that if you want location policies enforced in real time, use only the IP based condition and configure all addresses including both IPv4 and IPv6.
- There is also a deliberate exception in the other direction. Where a network topology means Entra sees an allowed egress IP while the resource provider sees a disallowed one, Entra issues a one-hour token that suspends IP checks at the resource. Organisations with stable topologies can remove that behaviour with Strict Location Enforcement, which is in public preview.
Four things that make CAE work as advertised.
We count the IP ranges
When the sum of all IP ranges in location policies exceeds 5,000, CAE cannot enforce the location change flow in real time and Entra issues a one-hour token instead. Nothing errors when you cross that line. Counting is a ten minute check that almost nobody has run, and large estates are frequently over it.
We check which location conditions you actually use
CAE has insight into IP-based named locations only. Country and region conditions and MFA trusted IPs are invisible to it, and where a user comes from one, Entra issues a one-hour token without the instant IP enforcement check. Organisations relying on country blocks for real-time control are relying on something else.
We put the guest gap in writing
CAE does not support guest user accounts, and revocation events and IP based policies are not enforced instantaneously for them. In UAE organisations working heavily with contractors and partner firms, that is a material exclusion, and it belongs in the risk register rather than in a documentation footnote nobody read.
We fix the runbook, not just the configuration
The deliverable people actually use is the offboarding procedure. It should say that critical events propagate in near real time with up to 15 minutes latency, that re-enabling a user takes 15 minutes in SharePoint and Teams and 35 to 40 in Exchange, and that a coauthoring session may persist until the document closes.
Four phases across roughly three to four weeks.
- 01Week 1
Establish what is already covered
Critical event evaluation is available in any tenant, so part of this is already working. The task is establishing which clients are CAE capable, which Office update channel is in use, and whether Web Account Manager has been disabled anywhere.
- Client versions and CAE capability established
- Office update channel confirmed per group
- WAM policy settings checked for CAE-breaking values
- Current CAE configuration state documented
- 02Week 2
Audit the location conditions
The sum of IP ranges across location policies counted against the 5,000 threshold, and location conditions reviewed for types CAE cannot see. Country and region conditions and MFA trusted IPs are identified because they silently prevent real-time enforcement.
- Total IP ranges counted against the 5,000 limit
- Non IP-based location conditions identified
- IPv4 and IPv6 coverage checked for completeness
- Network topology reviewed for IP variation exposure
- 03Week 3
Configure, migrate and decide on strict enforcement
CAE is now a Conditional Access session control, and tenants that configured the old settings under Security may need to migrate. Alongside that, a decision on whether the network topology is stable enough for Strict Location Enforcement.
- CAE configured as a Conditional Access session control
- Migration completed where legacy settings existed
- Strict enforcement decision recorded with reasoning
- Exclusions reviewed and justified
- 04Week 4
Update the runbooks with real numbers
The output that matters most. Offboarding and incident runbooks corrected so they state what actually happens and how quickly, including the guest account exclusion and the delay when re-enabling a user.
- Offboarding runbook updated with documented timings
- Incident revocation procedure verified end to end
- Guest account exclusion recorded as a known gap
- Service desk briefed on re-enable latency
Six situations where the revocation window is the risk.
An organisation offboarding staff at scale
High turnover means the offboarding procedure runs constantly, and any gap in it recurs constantly. Knowing that account disable propagates in near real time with up to 15 minutes latency, and that guests are excluded, turns a vague process into one with defined behaviour.
A regulated firm asked how quickly access can be cut
Supervisors and auditors ask this specifically, and the honest answer has numbers in it. Critical events near real time, IP location enforcement instant, policy and group membership changes up to one day. Producing those figures with the documentation behind them is a far better answer than immediately.
A business with a compromised account incident
Revoking refresh tokens is one of the five critical events, so it propagates near real time to enlightened services. What it does not do is reach guest accounts or non-CAE-capable clients, which is exactly what an incident responder needs to know before declaring containment.
An organisation restricting access by location
Location enforcement is where CAE is strongest and most conditional. It is instant, and only for IP-based named locations, and only below 5,000 total ranges. An estate relying on country conditions for real-time control has a different security model from the one it believes it has.
A provider where a departing clinician retains access
Where access to records must stop at the moment employment does, the gap between disabling an account and sessions ending is a governance question. CAE narrows it substantially, and the coauthoring behaviour and guest exclusion are the two remaining cases that need handling deliberately.
A tenant that configured CAE under the old Security settings
The CAE setting moved into Conditional Access, and tenants that previously enabled it for a subset of users must migrate before they can manage it there. Estates in that state frequently do not realise their configuration is now frozen behind a migration step.
What happens when you disable an account.
| Feature | CAE configured and understood | Critical events only, by default | Assumed instant, never tested |
|---|---|---|---|
Account disable revokes sessions | Near real time | Near real time | Assumed instant |
Location change enforced | Instant | Not enforced | Assumed |
Token lifetime | Up to 28 hours, event driven | One hour | One hour |
IP range count checked | Yes, against 5,000 | No | No |
Location condition types reviewed | Yes | No | No |
Client capability verified | Yes | Unknown | Unknown |
Guest exclusion known | Documented | Unknown | Unknown |
Runbook timings accurate | Yes | Partly | No |
Re-enable latency understood | Yes | No | No |
Revocation tested end to end | Yes | No | No |
Ten timings worth putting in your runbook.
| Action or condition | Documented behaviour | |
|---|---|---|
| Critical event, general | Near real time, up to 15 minutes propagation latency | |
| IP location policy enforcement | Instant | |
| Default token lifetime, no CAE | One hour | |
| Token lifetime in a CAE session | Long lived, up to 28 hours | |
| CA policy or group membership change | Up to one day, optimised to two hours in some cases | |
| Re-enabling a disabled user, SharePoint and Teams | Typically a 15 minute delay | |
| Re-enabling a disabled user, Exchange Online | Typically a 35 to 40 minute delay | |
| Coauthoring session, with a CA IP policy | Access lost on closing the document or app, or after one hour | |
| Coauthoring, network location policy configured | Maximum coauthoring session lifetime reduced to 15 minutes | |
| Over 5,000 IP ranges in location policies | One-hour CAE token, no real-time location change enforcement |
Five steps, and the last one is the deliverable people use.
- 1
Establish the baseline that already exists
Critical event evaluation does not rely on Conditional Access policies and is available in any tenant, so some of this is working already. Establishing which clients are CAE capable, and what the current configuration state is, tells you what you are adding rather than what you are starting.
- 2
Audit the location conditions and count the ranges
Total IP ranges counted against the 5,000 threshold, non IP-based conditions identified because CAE cannot see them, and IPv4 and IPv6 coverage confirmed. Microsoft is explicit that real-time location enforcement requires the IP based condition with all addresses configured.
- 3
Review client and channel readiness
CAE requires clients that understand a claim challenge. Office update channel matters: on Semi-Annual Enterprise Channel, DisableADALatopWAMOverride or DisableAADWAM enabled means CAE is not supported. Microsoft recommends organisations do not disable Web Account Manager.
- 4
Configure as a session control and migrate if needed
CAE is managed through Conditional Access, and tenants that configured it under the old Security settings for a subset of users must migrate first. Alongside it, a recorded decision on Strict Location Enforcement based on whether the network topology is genuinely stable.
- 5
Rewrite the runbooks with documented numbers
Offboarding and incident procedures updated to state actual behaviour: near real time with up to 15 minutes latency, instant for IP location, the guest exclusion, the coauthoring behaviour, and the re-enable delays of 15 minutes for SharePoint and Teams and 35 to 40 for Exchange.
What organisations ask about continuous access evaluation.
Fifteen questions to answer about your own tenant.
Coverage
- Do we know the five critical events?The list is finite.
- Are guests in scope of our access controls?CAE does not support guest accounts.
- Do we rely on country or region conditions?CAE cannot see them.
- Do we use MFA trusted IPs?Also invisible to CAE.
- Is SharePoint expected to act on user risk?It does not support user risk events.
Configuration
- How many IP ranges across all location policies?The threshold is 5,000.
- Are both IPv4 and IPv6 configured?Microsoft says include both.
- Did we configure CAE under the old Security settings?Migration may be needed.
- Is our topology stable enough for strict enforcement?It is in public preview.
- Are we sending traffic through Global Secure Access?It affects source IP visibility.
Clients and process
- Which Office update channel are we on?Semi-Annual has a CAE-breaking case.
- Has WAM been disabled anywhere?Microsoft recommends against it.
- Does our offboarding runbook state real timings?Not assumptions.
- Does the service desk know the re-enable delay?15 min SPO, 35 to 40 min EXO.
- Have we tested a revocation end to end?Once, deliberately.
Add up the IP ranges across every named location in your tenant.
If the total is over 5,000, CAE cannot enforce location changes in real time and Entra issues a one-hour token instead. Nothing warns you when you cross it, which is precisely why it is worth checking.
Related Services
Explore more solutions that work great with this service
Token Protection
A stolen token that only works on one device
Entra Conditional Access
The control that decides who reaches your data
Entra ID Protection
On P1 you see a flag. On P2 you see why, and can act on it
Emergency Access Accounts
Break-glass admin that actually works on the day
Entra Global Secure Access
Internet Access, Private Access and tenant restrictions
Phishing-Resistant MFA
The three methods that actually resist relay attacks
Privileged Identity Management
Just-in-time admin access, approval, and audit history you can download
Microsoft Entra
Identity and access management solutions