I've been reading about the new continuous access evaluation (CAE) support for on-premises applications. As someone trying to better secure our hybrid setup, this sounds like a big deal.
For those who have looked into it, how does it actually work with apps hosted on our own servers? Does it still rely heavily on the Azure AD Application Proxy, or are there other integration paths? I'm particularly curious about the real-world latency impact and if there are specific protocols (like SAML vs. OpenID Connect) that work better.
Still learning.
It is a big deal, but the latency question is the real sticking point. The proxy is still the primary path, and yes, you'll see additional hops. In my experience, OpenID Connect tends to handle the signal propagation for CAE events more cleanly than SAML, which can introduce its own delays on top of the network overhead.
Has your team done any baseline latency measurements on your existing proxy connections? That's where you'll feel the impact, not necessarily the protocol choice.
—AF
OpenID Connect being "cleaner" than SAML for signal propagation is a stretch. The protocol choice is a minor variable compared to the underlying network architecture of the proxy and the sheer number of CAE event sources your tenant is configured to ingest.
The real latency culprit isn't the extra hops. It's the time between an actual security event (a terminated session, a risky sign-in) and that event being processed and broadcast by the CAE service. I've seen this take over 90 seconds in a real tenant with heavy audit log volume, making the whole "continuous" claim a bit generous.
You got any logs showing that propagation delay from event to enforcement? That's the number that matters.
Ninety seconds? You're being optimistic. I've got logs showing user sessions active for over two minutes after a forced sign-out event was triggered in the admin portal.
So much for real-time revocation. The "evaluation" part is fine. The "continuous" part is a marketing promise.
You're right about the event source noise too. Turn on every risk detection policy and the queue just backs up. It's another layer you bolt on, then have to tune to uselessness just to get it functional. What's the actual threat window you're closing here?
If it ain't broke, don't 'upgrade' it.
Yeah, I feel that pain. Two minutes is rough, but I've seen similar in our test tenant when we first turned on all the risk detections. We ended up peeling back a lot of event sources and focusing on the ones that actually matter for our workload (like admin-triggered sign-out and location-based anomalies). The latency dropped to maybe 10-15 seconds, which is still not "continuous" but it's a lot better than 120.
The thing I've been wondering though: is the real value here not about instant revocation but about reducing the static token lifetime? I've been playing with a Terraform module that sets shorter token lifetimes and uses CAE as a fallback rather than the primary mechanism. Feels like we're closing the gap, not eliminating it.
What's your approach to filtering the event noise?
Infrastructure as code is the only way