Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.

2.2.2. Session Controls, Continuous Access Evaluation, and Device Restrictions

💡 First Principle: Granting access isn't the end of the decision — sessions live on for hours, and conditions change mid-session. Session controls shape how long and how richly the grant persists; continuous access evaluation lets critical changes interrupt a session that's already running.

The session control roster: Sign-in frequency forces reauthentication on a schedule (e.g., every 12 hours, or every time for the truly sensitive) by shrinking the effective session rather than trusting the default rolling window. Persistent browser session controls whether "stay signed in" survives browser restarts. Conditional Access app control routes the session through Defender for Cloud Apps' reverse proxy for in-session policing (block download, monitor — details in 4.4.2). App-enforced restrictions tell capable apps (Exchange Online, SharePoint) to degrade the experience for unmanaged devices — browser-only, no downloads — enforced by the app on CA's signal.

Continuous access evaluation (CAE) is the event-driven counterpart to sign-in frequency's timer: CAE-capable services (Exchange, SharePoint, Teams) subscribe to critical events — user disabled/deleted, password changed, refresh revoked, admin-flagged high risk, and network location changes against IP-based policies — and reject even unexpired tokens in near real time. CAE also enables strict location enforcement variants; know its limits: only participating services, and IP-location enforcement depends on the service seeing the same egress IP.

Device-enforced restrictions scenarios knit these together: "unmanaged devices may open documents in the browser but not download" = app-enforced restrictions (SharePoint limited access) driven by a CA session control; "block all access from non-compliant devices to Finance app" = grant control (require compliant device) instead. Grant controls gate entry; session controls shape the stay.

⚠️ Exam Trap: Sign-in frequency vs CAE — a stem about "revoke access within minutes of a user being disabled" wants CAE (or revocation), not a shorter sign-in frequency; "force reauthentication every 4 hours for this app" wants sign-in frequency. Timer vs event.

Reflection Question: Why can CAE enforce a disable event in minutes for Exchange Online but not for an arbitrary third-party SaaS app granted through the same tenant?

See how it connects
Alvin Varughese
Written byAlvin Varughese
Founder18 professional certifications