Modern Authentication and Token Lifecycle in Microsoft 365

The Secret Relay: How MSAL, Token Refresh & CAE Really Decide Your Conditional Access Outcomes

TL;DR (The Big Idea)

• Policies don’t enforce themselves—tokens do. CA is evaluated at token issue/refresh; existing tokens keep yesterday’s trust until you force reevaluation.

• MSAL silently swaps access tokens using refresh tokens; CAE can invalidate them mid-flight when risk or context changes.

• To make changes “stick now,” you must target the token lifecycle (sign-in frequency, revoke refresh tokens, CAE, session controls).

---

Plain-English Mental Model

• Access token (AT): short-lived badge (≈1h).

• Refresh token (RT): longer-lived wristband (days/weeks) that gets you new badges with no prompts.

• MSAL: the runner that trades RT→AT silently.

• Conditional Access (CA): policy engine applied at AT/RT issuance (and during CAE events).

• CAE (Continuous Access Evaluation): lets Azure AD pull access in-session (risk up, device non-compliant, location change, user disabled, etc.).

---

Why Your New Policy Didn’t Hit Today

• Users already hold valid ATs; no re-eval until expiry.

• RTs minted before your change still work until:

  • RT is presented again (next silent refresh), or

  • You revoke sessions/RTs, or

  • CAE triggers a forced recheck.

• Mobile/desktop apps (Teams/Outlook/OneDrive) aggressively cache & silently refresh, extending the “old policy” window.

---

Control Levers (in priority order)

1. Turn on CAE for supported apps (Exchange Online, SharePoint Online, Graph, Teams).

   • Effect: policy/risk changes can invalidate tokens mid-session.

2. Set Sign-in frequency (per-app CA Session control).

   • Examples: 8–12h for productivity apps; 1–4h for high-sensitivity admin portals.

3. Require reauth on context change

   • CA conditions: Sign-in risk ≥ Medium, User risk ≥ High, Device compliance required, Hybrid/AADJ only.

4. Use Conditional Access App Control (MDA session proxy) for unmanaged/risky sessions.

   • Enforce no download/print/sync; reduce blast radius while tokens phase out.

5. Revoke tokens on demand during rollouts/incidents

   • Targeted: Invalidate refresh tokens for affected users/groups.

   • Broad: Force sign-out + revoke across the tenant for emergency posture change.

6. Modern auth session settings

   • Prefer CA Session controls over legacy token lifetime policies (deprecated for most workloads).

---

Ready-to-Use Policies (minimal but effective)

1. Block when User risk = High

• Assign: All users (exclude 2 break-glass) + All cloud apps

• Conditions: User risk = High

• Grant: Block

• Session: Enable CAE (tenant setting)

1. Step-Up on Sign-in risk

• Assign: All users; Apps: Exchange, SharePoint, Admin portals

• Conditions: Sign-in risk ≥ Medium

• Grant: Require MFA; Require compliant device (for Admin portals)

1. Short sign-in frequency for admin

• Assign: Directory roles = Privileged

• Session: Sign-in frequency = 1–4h, Persistent browser session = Never

1. Contain unmanaged

• Assign: All users; Apps: SharePoint/OneDrive/Teams

• Device filter: Unmanaged

• Session: Use Conditional Access App Control (block download/print)

---

Operational Playbooks

Playbook A — “Make the new CA rule stick now”

• Scope: Group “Sensitive-Apps-Users”

• Steps:

  1. Set/adjust Sign-in frequency for target apps.

  2. Invalidate refresh tokens for the group.

  3. Post user comms (why extra prompts today).

  4. Monitor SignInLogs for new CA challenges; watch Helpdesk noise.

Playbook B — “Risk spike/compromise containment”

• Trigger: High-severity identity alert (risky user, impossible travel, DfI lateral movement)

• Actions (automate via Logic App):

  1. Confirm user compromised (sets User risk=High).

  2. Revoke refresh tokens + revoke sign-in sessions.

  3. Flip user to App Control policy for 72h.

  4. Require PW reset & device health check.

  5. Notify SOC & manager (Teams adaptive card).

---

Admin Commands & Endpoints (copy/paste)

• Microsoft Graph (recommended):

  • Revoke sessions (user): POST /users/{id}/revokeSignInSessions

  • Invalidate all refresh tokens (user): POST /users/{id}/invalidateAllRefreshTokens

  • Confirm risky user compromised: POST /identityProtection/riskyUsers/{id}/confirmCompromised

  • Dismiss false positive: POST /identityProtection/riskyUsers/{id}/dismiss

• PowerShell (Entra/AzureAD)

  • (Legacy) Revoke-AzureADUserAllRefreshToken -ObjectId <UserId>

  • MSGraph PowerShell: Invoke-MgGraphRequest -Method POST -Uri "/users/$id/revokeSignInSessions"

Tip: Prefer Graph for future-proofing. Build runbooks that accept UPN list and loop these calls with backoff.

---

Hunting & Monitoring (KQL)

Who kept using old tokens after a CA change?

SigninLogs | where TimeGenerated >= ago(24h) | extend ATIssue = parse_json(AuthenticationDetails)[0].Succeeded | extend CAResult = tostring(Status) | project TimeGenerated, UserPrincipalName, AppDisplayName, RiskDetail, ConditionalAccessStatus, CAResult, ATIssue | where ConditionalAccessStatus in ("notApplied","success") and RiskDetail == "none"

Silent RT churn spikes (possible scripted refresh abuse)

SigninLogs | where AuthenticationRequirement == "singleFactorAuthentication" | where TokenIssuerType == "AzureAD" and ResultType == 0 | summarize count() by UserPrincipalName, bin(TimeGenerated, 30m) | where count_ > 50

---

Metrics That Matter

• Time-to-enforce (policy change → first CA challenge) ↓

• Token revocation latency (action → user forced reauth) ↓

• Blocked risky sessions (per week) ↑ while false positives ↓

• Helpdesk auth tickets / 1k users stable after changes

• CAE invalidations correlated with risk spikes (proves in-session reaction)

• Privileged sign-in frequency adherence (no stale sessions) ↑

---

30/60/90 Execution Plan

Days 0–30 – Foundations

• Enable CAE; document supported apps.

• Implement User risk block & Sign-in risk step-up CA policies.

• Set Sign-in frequency: 8–12h (productivity), 1–4h (admin).

• Pilot App Control for unmanaged.

Days 31–60 – Token Discipline

• Build Graph runbook to bulk invalidate refresh tokens by group.

• Wire Playbook B to Defender alerts (risky user → revoke + contain).

• Trim persistent sessions; disable legacy token lifetime policies.

Days 61–90 – Zero Trust Tuning

• Expand CAE coverage; verify mid-session prompts work as intended.

• Add PIM guardrails (no elevation if user/sign-in risk ≥ Low/Medium).

• Stand up an Identity Session Health workbook (metrics above).

• Run a purple-team drill to validate revocation speed & CA enforcement.

---

Common Pitfalls (and safer defaults)

• Relying on policy only → Manage tokens (CAE + revoke + sign-in freq).

• One global sign-in frequency → Split admin vs worker apps.

• Tenant-wide revokes at noon → Stage by group/time zone (avoid outages).

• Ignoring mobile background refresh → Expect extra prompts; pre-communicate.

• No break-glass exclusion → Keep two monitored, tested break-glass accounts.

---

CAB One-Liner (Exec-friendly)

We tied policy to the token lifecycle. With CAE and targeted revocation, risk or policy changes take effect immediately, shrinking exposure windows without grinding work to a halt.

User comms (short)

You may see extra sign-in prompts today. We’re improving real-time protection so access adapts to context (location/device/risk). If you’re stuck, sign out/in or restart the app.