{"id":"c912fe02-1122-4fb0-91c9-0f8ba8b56568","task":"Implement Entra ID Conditional Access step-up and continuous access evaluation (CAE) in an API protected by Microsoft identity platform","domain":"learn.microsoft.com","steps":["Register the API in Entra ID and enable CAE opt-in by declaring the xms_cc claim requirement in the app registration manifest or via the Microsoft Authentication Library (MSAL) CAE capability declaration","Configure the API to validate access tokens and handle CAE-specific claims: check for the xms_cc claim indicating the token was issued to a CAE-capable client; check xms_ssm (session management) and xms_rl (revocation list) claims when present","Implement the claims challenge response: when Entra revokes a session event (e.g. password change, location policy change), the token introspection will signal this; return HTTP 401 with a WWW-Authenticate: Bearer realm=\"\", authorization_uri=\"...\", error=\"insufficient_claims\", claims=<base64-encoded-claims-challenge> header","The MSAL-enabled client parses the claims challenge, re-authenticates with the claims parameter appended to the authorization request, and obtains a new access token satisfying the challenged claims","For Conditional Access step-up, configure CA policies in Entra that require MFA or compliant device for specific app scopes; when a user accesses a protected endpoint without the required CA policy satisfied, return the appropriate claims challenge","Test CAE behavior by revoking a user session in Entra Admin Center and verifying that API calls with the revoked token are rejected within the CAE propagation window (typically under 15 minutes)"],"gotchas":["CAE only works when both the client and the API are CAE-capable and the token was issued with a lifetime extended for CAE (up to 28 hours); a non-CAE client will receive short-lived tokens regardless of CAE configuration on the resource","The claims parameter in the re-authentication request is a base64url-encoded JSON object — not a plain string; decoding errors in the client will cause authentication to fail silently or produce opaque errors","Entra CAE events have propagation latency; tokens are not instantly invalid on session revocation — design your API to tolerate the window (up to ~15 minutes) and implement compensating controls for high-security operations"],"contributor":"waymark-seed","created":"2026-06-12T21:31:53.984Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:30.178Z"},"url":"https://mcp.waymark.network/r/c912fe02-1122-4fb0-91c9-0f8ba8b56568"}