Network validation is configured through Universal Continuous Access Evaluation

Overview

Universal Continuous Access Evaluation (Universal CAE) validates network access tokens every time a connection is established through Global Secure Access tunnels. Without Universal CAE, tokens remain valid for 60 to 90 minutes regardless of changes to user state.

Without this protection:

• A threat actor who obtains a token through theft or replay can continue accessing all Global Secure Access-protected resources even after the user’s account is disabled or password is reset.
• Critical events like session revocation or high user risk detection don’t prompt immediate reauthentication.
• Departing employees or malicious insiders maintain network-level access to private corporate resources for up to 90 minutes after remediation action is taken.
• Token replay attacks from different IP addresses aren’t blocked without Strict Enforcement mode.

Remediation

• Review the Universal CAE capabilities for Global Secure Access.
• Remove or modify Conditional Access policies that disable CAE for Global Secure Access workloads. For more information, see Continuous access evaluation.
• Configure Universal CAE to use Strict Enforcement mode for enhanced token replay protection. For more information, see Universal Continuous Access Evaluation.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	Authentication
ATT&CK	T1550.001 Application Access Token
Licence	Entra_Premium_Private_Access, Entra_Premium_Internet_Access, AAD_PREMIUM
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.