Table of Contents
How Much User Activity is Actually Covered by Continuous Access Evaluation?
The September 3 article about revoking access tokens for risky Service Principals brought me back to the topic of Continuous Access Evaluation (CAE) and I began to look a little more deeply into the current state of CAE within Microsoft 365. What I discovered is a picture that’s considerably less rosy than the version depicted by Microsoft. I might have been a tad sanguine about the positive effect of CAE on Microsoft 365 operations. Let me explain why.
Microsoft made CAE generally available in January 2022. At the time, CAE covered core Microsoft 365 services (Exchange Online, SharePoint Online, and Teams). Since then, Microsoft has expanded CAE to cover more services (like Azure DevOps in 2025) and most recently, Power Platform (MC1446723, 3 August 2026).
Plunging Into CAE Weeds
Since its debut, administrators might have assumed that CAE protects all aspects of Microsoft 365 user sign-ins to Entra ID. In fact, it doesn’t, and the facts are laid out in great detail in a highly interesting post by Niklas Karner (September 2, 2026) from ERNW, a security company based in Germany. The post is from a 4-part series covering aspects of token theft in Entra ID and this post dives into CAE in a way that I haven’t seen done before. That being said, the fundamentals of CAE were described in an August 2022 post by MVP Fabian Bader.
I’m not a security researcher and I take the evidence presented in the article on its merits (I have asked Microsoft to comment). It’s worth considering the summary conclusions, presented here in my words rather than the original text:
CAE coverage for Microsoft Applications is Narrow: The article reports that only 33 of 740 inspected first-party resource tokens carried the CAE claim, indicating relatively limited CAE coverage across Microsoft’s first-party application ecosystem. Furthermore, the article notes that no public API exists to allow third-party servers to support CAE.
CAE coverage in Microsoft clients is inconsistent: The report says that Microsoft’s own applications sometimes don’t request CAE tokens when authenticating with Entra ID to use servers like Exchange Online and SharePoint Online which support CAE.
Clients Decide Whether to Support CAE. Clients can ask for CAE tokens or plain tokens. Neither Entra ID nor CAE-capable servers enforce a requirement to use CAE tokens. My assumption is the reason was probably to accommodate backwards compatibility with older clients, but four and a half years into the CAE journey, Microsoft clients should use CAE tokens whenever possible.
Token Protection Complements CAE. Token protection is a conditional access session control to force the use of device-bound tokens by Entra ID. The idea is to stop attackers with stolen refresh tokens requesting access tokens.
Extended Token Lifetimes Aren’t Necessarily Good. A CAE token can be valid for up to 28 hours rather than the normal 60-90 minutes. Microsoft’s documentation says that “Token lifetime increases to long-lived, up to 28 hours, in CAE sessions. Critical events and policy evaluation drive revocation, not just an arbitrary time period. This change increases the stability of applications without affecting security posture.” The stance is perfectly reasonable if all applications and all clients use CAE to respect critical events, but they don’t. Vasil Michev wrote about the potential effect of the extended token lifetime in a May 2024 blog, which is worth reading for further background.
Using the SignInFrequency session control in conditional access policies has the side-effect of reducing the 28-hour token lifetime back to the normal 60 to 90 minutes. This is understandable because a policy that enforces sign-in frequency is incompatible with extended token lifetimes.
Conditional Access Based MFA isn’t Critical. The report says that the “MFA enabled for the user” CAE event only applies to the legacy per-user MFA implementation. It doesn’t work when conditional access policies enforce MFA, which is what Microsoft wants tenants to use. Logically, I can understand why policy-based enforcement isn’t the same kind of “event” as the older one-time enablement, but it’s interesting that Microsoft has not made this point clear.
In addition to the above, the article presents some interesting observations about how quickly applications revoking access in response to CAE events.
Checking CAE Usage
The Entra admin center supports a filter to find user sign-ins where a CAE token is used (Figure 1).
From an analysis perspective, it’s more interesting to use PowerShell to fetch CAE-enabled sign-in events. For example, here’s how to use the Microsoft Graph PowerShell SDK to filter for sign-in events for a user which use CAE tokens. The lookup is against the beta endpoint because it reveals more data about sign-in events.
[array]$Logs = Get-MgBetaAuditLogSignIn -Filter "userPrincipalName eq 'lotte.vetler@office365itpros.com' and AuthenticationProcessingDetails/any(x:x/key eq 'is CAE Token' and x/value eq '1')" -All
To get an overview of what’s happening across the tenant, you could do something like this (on larger tenants, trim the number of days fetched to keep the data within reasonable limits):
[array]$Logs = Get-MgBetaAuditLogSignIn -Filter "AuthenticationProcessingDetails/any(x:x/key eq 'is CAE Token' and x/value eq '1')" -All $Logs | Group-Object AppDisplayName -NoElement | Sort-Object Count -Descending | Format-Table Name, Count -AutoSize Name Count ---- ----- Office 365 SharePoint Online 24 Microsoft 365 Admin portal 13 Microsoft Office 365 Portal 1
Basically, this information tells me that in my tenant over the last 30 days, CAE tokens were used for sign-ins to SharePoint Online, the Microsoft 365 admin center, and the Microsoft 365 Apps portal. Remember, this is a small tenant that isn’t used by many people and that the data for your tenant might include other Microsoft apps, but the number of first-party apps using CAE isn’t large.
Good CAE, Poor Exploitation?
I still think CAE is a good feature to have. What’s disappointing is that CAE appears to be much less pervasive across the Microsoft 365 ecosystem than many administrators probably assume. Four and a half years after general availability, wide gaps remain in application and client support. Quite why this is the case is anyone’s guess.
Learn how to use Entra ID and to exploit the data available to Microsoft 365 tenant administrators through the Microsoft 365 for IT Pros eBook. We love figuring out how things work.