How Do You Configure Continuous Access Evaluation for App Sign-Ins?

Why the Answer Is Correct

Continuous access evaluation in Microsoft Entra is not a separate toggle you configure on an app; it is delivered and scoped through Conditional Access. A Conditional Access policy with the continuous access evaluation session control ("Customize continuous access evaluation") lets you define which users, groups, or directory roles get strict enforcement in near real time. Because the requirement is to assign the configuration to users holding the Application Administrator role, the policy's user assignment is where that role is targeted. CAE then acts on token issuance and refresh events, so critical events such as account disablement or password change are honored quickly. As ProNerd explained, CAE is about "making conditional access checks for token refreshes at the time of expiration" so a disabled user or changed IP is caught promptly.

Why the Other Options Are Wrong

A sign-in risk policy (A) is a Conditional Access policy built on Microsoft Entra ID Protection signals, used to require MFA or password change when sign-in risk is detected; it does not contain the continuous access evaluation session control that scopes CAE to the Application Administrator role. An access review (B) is a scheduled recertification of group membership, role assignments, or application access — it is periodic, not an evaluation of live tokens or sign-in sessions, and as the learner Siraf reasoned, "This implies access review to apps" is a keyword-level guess that does not match CAE's real-time behavior. Admin consent settings (D) govern how users and admins consent to application permissions and the admin consent request workflow, which is unrelated to session evaluation or token lifetime.

Community Comment Notes

Every recorded vote went to the Conditional Access policy, and YesPlease pointed directly at the Microsoft Learn concept page on continuous access evaluation. klayytech outlined CAE prerequisites and the Conditional Access dependency, though their note that it is "in preview" is outdated — CAE is generally available and always on for Microsoft 365 workloads. jarattdavis summed up the rationale that Conditional Access policies allow enforcement of real-time access decisions, while Siraf's access review pick shows exactly the distractor the exam wants you to avoid. Use these comments as confirmation only; the question wording plus Microsoft's documentation is what settles the answer.