{"id":52317,"date":"2023-03-16T15:00:01","date_gmt":"2023-03-16T14:00:01","guid":{"rendered":"https:\/\/cm-edgetun.pages.dev\/en-gb\/industry\/blog\/?p=52317"},"modified":"2023-03-20T22:37:52","modified_gmt":"2023-03-20T21:37:52","slug":"enforcing-azure-active-directory-security-via-continuous-access-evaluation","status":"publish","type":"post","link":"https:\/\/cm-edgetun.pages.dev\/en-gb\/industry\/blog\/technetuk\/2023\/03\/16\/enforcing-azure-active-directory-security-via-continuous-access-evaluation\/","title":{"rendered":"Enforcing Azure Active Directory security via Continuous Access Evaluation"},"content":{"rendered":"

\"An<\/p>\n

Microsoft\u2019s Azure AD Identity Protection and Azure AD Conditional Access provides the ability to\u00a0monitor user sign-in attempts and analyse them for risk<\/a>. Reducing the risk of a compromised account or a risky sign-in attempt from successfully completing an authentication and authorisation attempt is quite important, but what if circumstances change after a user has successfully logged in?<\/p>\n

An end user is issued with an OAuth 2.0 access token at the time of a successful authentication, and that token has a lifespan making the end user\u2019s session valid until that token expires. Configurable Token Lifetime policy is one hour by default unless configured otherwise. Imagine, however, if you\u2019re an admin who needs to block a specific user\u2019s access immediately, or if the service detects that a user is now accessing authenticated driven data from a free Wi-Fi at a coffee shop instead of from their corporate office. The end user\u2019s non-expired access token would need to be immediately revoked forcing them to re-attempt authentication and authorisation – which will fail if their account has been disabled or may present them with a multi-factor authentication challenge because of their new location.<\/p>\n

This is addressed via Continuous Access Evaluation, which provides a standard way for an identity provider or a service (also known as the relaying party or resource provider) to stop honouring a valid token and to re-issue an authentication and authorisation attempt. Sonia Cuff<\/a>\u00a0has recently shared a brilliant writeup detailing how with Continuous Access Evaluation in place, the lifespan of a token is no longer important, as we can re-challenge a user whenever circumstances change, without having to wait for their token to expire.<\/p>\n

As you are aware, our team thrives on IT Professionals feedback which inspires the content we create. This includes technical articles<\/a>, demo videos and interviews<\/a>. We are also actively monitoring and engaging with the\u00a0<\/span>#AzOps<\/span><\/a>\u00a0hashtag on twitter. Feel free to reach out with any of your questions as our team is always happy to help.<\/span><\/p>\n

Learn more<\/h3>\n