---
source_url: "https://docs.azure.cn/en-us/entra/architecture/resilience-with-continuous-access-evaluation"
title: "Build resilience by using Continuous Access Evaluation in Microsoft Entra ID | Azure Docs"
mirrored_at: 2026-08-13T03:41:07.134Z
host: docs.azure.cn
cited_in_42a: true
mirror_canonical: "https://index.42a.ai/docs.azure.cn/en-us/entra/architecture/resilience-with-continuous-access-evaluation"
---

> **Original source:** https://docs.azure.cn/en-us/entra/architecture/resilience-with-continuous-access-evaluation

[Continuous Access Evaluation (CAE)](https://docs.azure.cn/en-us/entra/identity/conditional-access/concept-continuous-access-evaluation) allows Microsoft Entra applications to subscribe to critical events that can then be evaluated and enforced. CAE includes evaluation of the following events:

-   User account deleted or disabled
-   Password for user changed
-   MFA enabled for user
-   Administrator explicitly revokes a token
-   Elevated user risk detected

As a result, applications can reject unexpired tokens based on the events signaled by Microsoft Entra ID as depicted in the following diagram.

![conceptualiagram of CAE](https://docs.azure.cn/en-us/entra/architecture/media/resilience-with-cae/admin-resilience-continuous-access-evaluation.png)

## How does CAE help?

The CAE mechanism allows Microsoft Entra ID to issue longer-lived tokens while enabling applications to revoke access and force reauthentication only when needed. The net result of this pattern is fewer calls to acquire tokens, which means that the end-to-end flow is more resilient.

To use CAE, both the service and the client must be CAE-capable. Microsoft 365 services such as Exchange Online, Teams, and SharePoint Online support CAE. On the client side, browser-based experiences that use these Office 365 services (such as Outlook Web App) and specific versions of Office 365 native clients are CAE-capable. More Azure cloud services will become CAE-capable.

Microsoft is working with the industry to build [standards](https://openid.net/wg/sse/) that will allow third party applications to use CAE capability. You can also develop applications that are CAE-capable. For more information about CAE-capable application development, see [How to build resilience in your application](https://docs.azure.cn/en-us/entra/architecture/resilience-app-development-overview).

## How do I implement CAE?

-   [Update your code to use CAE-enabled APIs](https://docs.azure.cn/en-us/entra/identity-platform/app-resilience-continuous-access-evaluation).
-   [Enable CAE](https://docs.azure.cn/en-us/entra/identity/conditional-access/concept-continuous-access-evaluation) in the Microsoft Entra Security Configuration.
-   Ensure that your organization is using [compatible versions](https://docs.azure.cn/en-us/entra/identity/conditional-access/concept-continuous-access-evaluation) of Microsoft Office native applications.

## Next steps

### Resilience resources for administrators and architects

-   [Build resilience with credential management](https://docs.azure.cn/en-us/entra/architecture/resilience-in-credentials)
-   [Build resilience with device states](https://docs.azure.cn/en-us/entra/architecture/resilience-with-device-states)
-   [Build resilience in your hybrid authentication](https://docs.azure.cn/en-us/entra/architecture/resilience-in-hybrid)

### Resilience resources for developers

-   [Build IAM resilience in your applications](https://docs.azure.cn/en-us/entra/architecture/resilience-app-development-overview)
-   [Build resilience in your CIAM systems](https://docs.azure.cn/en-us/entra/architecture/resilience-b2c)