The account was disabled at nine in the morning. Without CAE their Outlook carried on working until the token ran out on its own.
An access token stays valid for an hour by default, and disabling an account does nothing to a session already holding one. Continuous access evaluation shuts that window by letting Exchange, SharePoint and Teams subscribe to critical Entra events and stop honoring tokens in near real time. Any American business whose HIPAA and SOC 2 procedures promise prompt termination of access needs this, because it is the mechanism that turns the promise into something true.
- 5 eventsCritical events evaluated in near real time
- 15 minutesMaximum observed propagation latency
- InstantIP location policy enforcement
- Any tenantCritical event evaluation needs no CA policy
Eight things to understand before you rely on it.
Critical event evaluation, available in any tenant
Services that support it subscribe to critical Entra events and act on them in near real time. Critical event evaluation is explicitly documented as not depending on Conditional Access policies, which means it works in any tenant at all. That is the half of CAE most businesses are already benefiting from without anybody having configured a thing.
The five events that are evaluated
The list runs to five: the account is deleted or disabled, a password is changed or reset, multifactor authentication is turned on for that user, an administrator explicitly revokes all refresh tokens, or Entra ID Protection detects high user risk. That list has an end, and understanding that it has an end is the whole point of reading it.
How fast near real time actually is
Near real time is the stated goal, with latency of up to fifteen minutes possible because events take time to propagate. IP location policy enforcement is a different matter entirely and happens instantly. Two separate numbers, and quoting the wrong one in an incident runbook sets an expectation somebody will rely on at the worst moment.
Conditional Access policy evaluation inside the service
Exchange Online, SharePoint Online, Teams and Microsoft Graph are each able to synchronize key Conditional Access policies and evaluate them inside the service itself. That is the mechanism allowing access to stop the instant a network location changes, rather than waiting for the next token refresh to notice.
Token lifetime becomes long lived on purpose
Inside a CAE-aware session the token becomes long lived, stretching up to 28 hours, because revocation is now driven by events rather than by the clock running out. Note that the configurable token lifetime policy is not honored for CAE-aware clients. Where the clients are not CAE-capable, the default access token lifetime stays at one hour as before.
Only IP-based named locations are visible to CAE
Visibility extends to IP-based named locations and nothing else. MFA trusted IPs are invisible to it, as are country and region based locations. Where a user arrives from one of those, CAE is not enforced once they move, and Entra issues a one-hour token with no instant IP enforcement check applied to it at all.
Guest accounts are not covered
Guest accounts are not supported, and that is stated directly. Neither revocation events nor IP-based Conditional Access policies are enforced instantaneously for them. Any American business working extensively with contractors and outside firms needs that exclusion written explicitly into its risk picture rather than left as an assumption.
Client support determines whether any of it works
The whole thing depends on the client understanding a claim challenge, which means bypassing its own token cache the moment a resource provider rejects a token that has not expired. That requires clients kept current. On Semi-Annual Enterprise Channel, if either DisableADALatopWAMOverride or DisableAADWAM is enabled, CAE is not supported at all.
Go beyond 5,000 IP ranges in your location policies and real-time location enforcement simply stops working.
The threshold is documented precisely. Once the total of every IP range specified across your location policies passes 5,000, CAE loses the ability to enforce the user location change flow in real time.
- What Entra does instead is issue a one-hour CAE token. Every other event and policy continues to be enforced, with client location change events being the sole exception, so you remain better off than you would be with traditional one-hour tokens. What you no longer have is the instant location enforcement you were counting on.
- It matters most to businesses that have accumulated named locations across years, adding one branch or one supplier at a time. Crossing 5,000 goes unnoticed because nothing breaks and nothing errors. Enforcement quietly becomes less immediate and that is all. Counting the ranges takes ten minutes, and almost no team has ever done it.
- Sitting next to that is the question of which location types CAE can see in the first place. IP-based named locations only. Not MFA trusted IPs, and not country or region conditions. The guidance is explicit: if you want your location policies enforced in real time, use the IP-based condition and nothing else, and configure every address including both IPv4 and IPv6.
- An exception exists in the opposite direction too, and it is deliberate. Where your network topology causes Entra to see an allowed egress IP while the resource provider sees a disallowed one, Entra issues a one-hour token that suspends IP checks at the resource end. Businesses with a stable topology can remove that behavior using Strict Location Enforcement, currently in public preview.
Four things that make CAE work as advertised.
We count the IP ranges
Once every IP range across your location policies adds up to more than 5,000, CAE can no longer enforce the location change flow in real time, and Entra falls back to issuing a one-hour token. Crossing that line produces no error of any kind. Counting takes ten minutes, almost nobody has ever done it, and large estates are over the line more often than not.
We check which location conditions you actually use
Only IP-based named locations are visible to it. Country and region conditions are invisible, as are MFA trusted IPs, and where a user arrives from one of those Entra issues a one-hour token with no instant IP enforcement check attached. Any business relying on country blocks for real-time control is relying on something that does not do that.
We put the guest gap in writing
Guest accounts fall outside support, which means neither revocation events nor IP-based policies are enforced instantaneously against them. For an American business working heavily with contractors and partner firms, that is a material exclusion. It belongs on the risk register, not in a documentation footnote nobody has read.
We fix the runbook, not just the configuration
The deliverable people actually use is the offboarding procedure. It should say that critical events propagate in near real time with up to 15 minutes latency, that re-enabling a user takes 15 minutes in SharePoint and Teams and 35 to 40 in Exchange, and that a coauthoring session may persist until the document closes.
Four phases across roughly three to four weeks.
- 01Week 1
Establish what is already covered
Since critical event evaluation works in any tenant, some of this is already running for you. The work is establishing which of your clients are CAE capable, which Office update channel they sit on, and whether Web Account Manager has been disabled anywhere in the estate.
- Client versions and CAE capability established
- Office update channel confirmed per group
- WAM policy settings checked for CAE-breaking values
- Current CAE configuration state documented
- 02Week 2
Audit the location conditions
We count the total IP ranges across every location policy and measure it against the 5,000 threshold, then review the location conditions for types CAE has no visibility of. Country and region conditions and MFA trusted IPs get identified specifically, because each one silently prevents real-time enforcement without producing any signal at all.
- Total IP ranges counted against the 5,000 limit
- Non IP-based location conditions identified
- IPv4 and IPv6 coverage checked for completeness
- Network topology reviewed for IP variation exposure
- 03Week 3
Configure, migrate and decide on strict enforcement
CAE now lives as a Conditional Access session control, so any tenant that configured the older settings under Security may need migrating across. Alongside that comes a decision to make: is your network topology stable enough to justify Strict Location Enforcement.
- CAE configured as a Conditional Access session control
- Migration completed where legacy settings existed
- Strict enforcement decision recorded with reasoning
- Exclusions reviewed and justified
- 04Week 4
Update the runbooks with real numbers
Of everything produced, this matters most. Your offboarding and incident runbooks get corrected so they describe what genuinely happens and how fast, guest account exclusion included, along with the delay that applies when re-enabling a user.
- Offboarding runbook updated with documented timings
- Incident revocation procedure verified end to end
- Guest account exclusion recorded as a known gap
- Service desk briefed on re-enable latency
Six situations where the revocation window is the risk.
An organization offboarding staff at scale
Where turnover is high the offboarding procedure runs continually, which means any gap in it recurs continually too. Knowing that disabling an account propagates in near real time with up to fifteen minutes of latency, and that guests sit outside that entirely, turns a vague process into one with behavior you can actually state.
A regulated business asked to say how fast it can cut access
Auditors, examiners and SOC 2 assessors all ask this question specifically, and an honest answer contains numbers. Critical events in near real time. IP location enforcement instantly. Policy and group membership changes taking up to a day. Handing over those figures with the documentation standing behind them lands considerably better than the word immediately.
A business with a compromised account incident
Refresh token revocation is one of the five critical events, so it reaches the enabled services in near real time. Where it does not reach is guest accounts and any client that is not CAE-capable. That is precisely what an incident responder has to know before declaring containment achieved.
An organization restricting access by location
Location enforcement is simultaneously where this is strongest and where it carries the most conditions. It is instant, it applies to IP-based named locations only, and it works only while you stay below 5,000 total ranges. An estate leaning on country conditions for real-time control is operating a different security model from the one it believes it has.
A provider where a departing clinician retains access
When access to patient records has to end the moment employment does, the gap between disabling an account and the sessions actually ending stops being a technicality and becomes a HIPAA workforce termination question. CAE narrows that gap substantially. Two cases still need deliberate handling on top of it: the coauthoring behavior, and the exclusion of guest accounts.
A tenant still carrying CAE configuration from the old Security settings
The setting has moved into Conditional Access, and any tenant that previously enabled it for a subset of users has to migrate before it can be managed there. Estates sitting in that state frequently have no idea their configuration is now frozen behind a migration step nobody has scheduled.
What happens when you disable an account.
| Feature | CAE configured and understood | Critical events only, by default | Assumed instant, never tested |
|---|---|---|---|
Account disable revokes sessions | Near real time | Near real time | Assumed instant |
Location change enforced | Instant | Not enforced | Assumed |
Token lifetime | Up to 28 hours, event driven | One hour | One hour |
IP range count checked | Yes, against 5,000 | No | No |
Location condition types reviewed | Yes | No | No |
Client capability verified | Yes | Unknown | Unknown |
Guest exclusion known | Documented | Unknown | Unknown |
Runbook timings accurate | Yes | Partly | No |
Re-enable latency understood | Yes | No | No |
Revocation tested end to end | Yes | No | No |
Ten timings worth putting in your runbook.
Action or condition
Critical event, general
- Documented behavior
- Near real time, up to 15 minutes propagation latency
Action or condition
IP location policy enforcement
- Documented behavior
- Instant
Action or condition
Default token lifetime, no CAE
- Documented behavior
- One hour
Action or condition
Token lifetime in a CAE session
- Documented behavior
- Long lived, up to 28 hours
Action or condition
CA policy or group membership change
- Documented behavior
- Up to one day, optimized to two hours in some cases
Action or condition
Re-enabling a disabled user, SharePoint and Teams
- Documented behavior
- Typically a 15 minute delay
Action or condition
Re-enabling a disabled user, Exchange Online
- Documented behavior
- Typically a 35 to 40 minute delay
Action or condition
Coauthoring session, with a CA IP policy
- Documented behavior
- Access ends when the document or application closes, or after an hour
Action or condition
Coauthoring, network location policy configured
- Documented behavior
- Maximum coauthoring session lifetime reduced to 15 minutes
Action or condition
Over 5,000 IP ranges in location policies
- Documented behavior
- A one-hour CAE token is issued, with no real-time enforcement of location changes
Five steps, and it is the last of them that produces the thing people actually use.
- 1
Establish the baseline that already exists
Because critical event evaluation does not depend on Conditional Access policies and works in any tenant, part of this is running for you today. Establishing which of your clients are CAE capable, and what the current configuration state actually is, tells you what you are adding rather than letting you assume you are starting from zero.
- 2
Audit the location conditions and count the ranges
We count your total IP ranges against the 5,000 threshold, identify every non IP-based condition on the grounds that CAE cannot see any of them, and confirm both IPv4 and IPv6 are covered. The requirement is explicit: real-time location enforcement needs the IP-based condition with every address configured.
- 3
Review client and channel readiness
This needs clients capable of understanding a claim challenge, which makes your Office update channel relevant. On Semi-Annual Enterprise Channel, having either DisableADALatopWAMOverride or DisableAADWAM enabled means CAE is not supported at all. The standing recommendation is that Web Account Manager should not be disabled.
- 4
Configure as a session control and migrate if needed
Management now happens through Conditional Access, so any tenant that configured this under the old Security settings for a subset of users has to migrate before anything else. Alongside that we record a decision on Strict Location Enforcement, taken on whether your network topology is genuinely stable rather than on whether it usually is.
- 5
Rewrite the runbooks with documented numbers
Your offboarding and incident procedures get rewritten to state what genuinely happens. Near real time with up to fifteen minutes of latency. Instant for IP location. Guests excluded. The coauthoring behavior spelled out. And the re-enable delays recorded honestly at fifteen minutes for SharePoint and Teams, thirty five to forty for Exchange.
What US organizations ask about continuous access evaluation.
Fifteen questions to answer about your own tenant.
Coverage
- Do we know the five critical events?The list is finite.
- Are guests in scope of our access controls?CAE does not support guest accounts.
- Do we rely on country or region conditions?CAE cannot see them.
- Do we use MFA trusted IPs?Also invisible to CAE.
- Is SharePoint expected to act on user risk?It does not support user risk events.
Configuration
- How many IP ranges across all location policies?The threshold is 5,000.
- Are both IPv4 and IPv6 configured?Microsoft says include both.
- Did we configure CAE under the old Security settings?Migration may be needed.
- Is our topology stable enough for strict enforcement?It is in public preview.
- Do we know which apps synchronize CA policies?Exchange, SharePoint, Teams and Graph.
Clients and process
- Which Office update channel are we on?Semi-Annual has a CAE-breaking case.
- Has WAM been disabled anywhere?Microsoft recommends against it.
- Does our offboarding runbook state real timings?Not assumptions.
- Does the service desk know the re-enable delay?15 min SPO, 35 to 40 min EXO.
- Have we tested a revocation end to end?Once, deliberately.
Total up the IP ranges across every named location your tenant holds.
Should that total come out above 5,000, location changes can no longer be enforced in real time and Entra falls back to a one-hour token. Nothing anywhere warns you when you cross that line, which is exactly why somebody has to go and count.
Related Services
Explore more solutions that work great with this service
Microsoft Entra Token Protection
Tokens bound to the device that requested them
Learn moreMicrosoft Entra Conditional Access Design
Conditional Access design and review for US organizations:
Learn moreMicrosoft Entra ID Protection
Entra ID Protection deployment for US organizations: establishing
Learn moreEmergency Access Account Design
Break-glass emergency access account programs for US organizations:
Learn morePhishing-Resistant MFA
Phishing-resistant multifactor authentication for US organizations:
Learn moreMicrosoft Entra
Identity and access management solutions
Learn more