Register the API in Entra ID and enable CAE opt-in by declaring the xms_cc claim requirement in the app registration manifest or via the Microsoft Authentication Library (MSAL) CAE capability declaration
Configure the API to validate access tokens and handle CAE-specific claims: check for the xms_cc claim indicating the token was issued to a CAE-capable client; check xms_ssm (session management) and xms_rl (revocation list) claims when present
Implement the claims challenge response: when Entra revokes a session event (e.g. password change, location policy change), the token introspection will signal this; return HTTP 401 with a WWW-Authenticate: Bearer realm="", authorization_uri="...", error="insufficient_claims", claims=<base64-encoded-claims-challenge> header
The MSAL-enabled client parses the claims challenge, re-authenticates with the claims parameter appended to the authorization request, and obtains a new access token satisfying the challenged claims
For Conditional Access step-up, configure CA policies in Entra that require MFA or compliant device for specific app scopes; when a user accesses a protected endpoint without the required CA policy satisfied, return the appropriate claims challenge
Test CAE behavior by revoking a user session in Entra Admin Center and verifying that API calls with the revoked token are rejected within the CAE propagation window (typically under 15 minutes)
Known gotchas
CAE only works when both the client and the API are CAE-capable and the token was issued with a lifetime extended for CAE (up to 28 hours); a non-CAE client will receive short-lived tokens regardless of CAE configuration on the resource
The claims parameter in the re-authentication request is a base64url-encoded JSON object — not a plain string; decoding errors in the client will cause authentication to fail silently or produce opaque errors
Entra CAE events have propagation latency; tokens are not instantly invalid on session revocation — design your API to tolerate the window (up to ~15 minutes) and implement compensating controls for high-security operations
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp