Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000189

Conditional Access policy in Entra ID missing Continuous Access Evaluation (CAE)

High
Entra ID
Defense Evasion Persistence Privilege Escalation
v8

Signature Identity

CTD-000189
Threat ID
8
Version
IOE
Indicator Type

Threat Description

This detection identifies Conditional Access policies in Entra ID that do not enforce Continuous Access Evaluation (CAE). CAE enables near real-time policy enforcement by revoking tokens when events such as user disablement, location changes, or role elevation occur.

Without CAE, OAuth access and refresh tokens remain valid until their expiration, even if a user’s risk state or session conditions change. This extends the window for attackers to maintain access after privilege elevation or credential compromise.

MITRE ATT&CK: Attack Tactics

Defense Evasion Persistence Privilege Escalation

D3FEND: Defend Tactics

D3-ACH (Application Configuration Hardening)

Remediation

  1. Sign in to Microsoft entra admin center with a Global Administrator account.
  2. Go to Entra ID > Security > Conditional Access.
  3. Select the Conditional Access policy you want to update (for example, AllUsers-MFA-Access).
  4. Under Access controls > Session, enable Use Conditional Access App Control.
  5. Verify that the targeted cloud apps support Continuous Access Evaluation (CAE). See Microsoft’s list: Apps that support CAE.
  6. Save the updated policy and test it in Report-only mode before enforcing in production.
  7. Use Sign-in logs to confirm that CAE is triggering token re-evaluations.
  8. Review token lifetime policies to make sure they align with CAE.

Frequently Asked Questions

What does Conditional Access policy in Entra ID missing Continuous Access Evaluation (CAE) mean?

A Conditional Access policy in Entra ID is configured without Continuous Access Evaluation (CAE), which means that OAuth access and refresh tokens remain valid until their expiration, even if a user's risk state or session conditions change. This extends the session duration for users who have elevated privileges or compromised credentials.

This configuration allows attackers to maintain access to sensitive resources for an extended period after privilege elevation or credential compromise, enabling them to continue malicious activity. The prolonged session duration increases the risk of unauthorized data access and exfiltration.

Attackers can exploit this vulnerability by elevating privileges or compromising credentials, then maintaining access to sensitive resources until the token expiration. This allows them to continue malicious activity for an extended period after initial compromise.

Cayosoft Guardian continuously monitors Conditional Access policies in Entra ID for the absence of CAE, providing visibility into a critical security control that is easy to overlook and ensuring timely detection of this issue.

Cayosoft Guardian helps reduce this risk by alerting administrators to enable CAE in their Conditional Access policies, ensuring that OAuth tokens are revoked promptly when user risk states or session conditions change. This limits the extended session duration and reduces the likelihood of prolonged access for attackers.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Entra ID
Themes
Tenant-wide
Attack Tactics
Defense Evasion Persistence Privilege Escalation
Defend Tactics
D3-ACH (Application Configuration Hardening)
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical