An enterprise is implementing Continuous Access Evaluation (CAE) for applications that consume Azure AI services. A user's account is disabled in Microsoft Entra ID while they have an active session with Azure AI services. How does CAE affect the user's session?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Continuous Access Evaluation (CAE) establishes a backchannel between Microsoft Entra ID and CAE-capable resource providers. When a user account is disabled (a critical event), Entra ID pushes a real-time notification to the resource provider (such as Azure services that support CAE).
Full explanation below image
Full Explanation
B is correct because Continuous Access Evaluation (CAE) establishes a backchannel between Microsoft Entra ID and CAE-capable resource providers. When a user account is disabled (a critical event), Entra ID pushes a real-time notification to the resource provider (such as Azure services that support CAE). The resource provider then rejects the user's access token immediately—well before the normal 60-75 minute expiration—effectively terminating the session within seconds to minutes. A is wrong because this describes token behavior WITHOUT CAE; CAE was designed specifically to eliminate this window where a disabled account's token remains valid. C is wrong because prompting for MFA is a step-up authentication action; disabling an account should terminate access, not challenge to MFA. D is wrong because while token revocation normally works via refresh token expiry, CAE enables the resource provider to reject active access tokens for critical events like account disablement.