Comments on: Why Continuous Access Evaluation (CAE) for Azure AD Matters

By: Thijs Lecomte

Thijs Lecomte — Sun, 29 Jan 2023 13:47:20 +0000

In reply to Frank Ludovic. Hi Frank A workload identity is an app registration with application permissions. So this means a backend script running or a scheduled task. For those app registrations which are using the Graph API (no other API's are supported), CAE will take into effect

By: Frank Ludovic

Frank Ludovic — Mon, 16 Jan 2023 15:08:07 +0000

Hello,

Thank you for your article, in Microsoft documentation about CAE for Workload identities “The continuous access evaluation for workload identities public preview scope includes support for Microsoft Graph as a resource provider.
The preview targets service principals for line of business (LOB) applications”
That’s mean CAE for workload also support thirt party application registred in Azure AD ?

Thank you for your reply

By: David Gorman

David Gorman — Thu, 31 Mar 2022 07:56:47 +0000

In reply to Thijs Lecomte. Yes, we use known IP addresses in some CA polices. I might see if they could be based more on the device itself rather than IP though.

By: Thijs Lecomte

Thijs Lecomte — Wed, 23 Mar 2022 10:46:30 +0000

In reply to Dave. I fear that's not going to be possible. Did it cause reauthentication at that time? Do you have different CA policies setup based on IP locations?

By: Dave

Dave — Wed, 23 Mar 2022 09:24:22 +0000

This seems excellent but I was running into issues when I had to connect/disconnect from the VPN. Obviously it makes sense, my IP and location had changed, but it was annoying.

Wondering if in future we could identify networks that don’t count as “change”.