Implement Authentication and Access Management · Topic 4 of 6
Conditional Access Session Controls and Protected Actions
SC-300 session controls: sign in frequency, continuous access evaluation, token protection, authentication context, app enforced restrictions and protected actions.
- 5 min
- Session controls include sign in frequency, persistent browser, application enforced restrictions, Conditional Access App Control, CAE and token protection.
- CAE reacts in near real time to events such as disabling an account or revoking a session, and is on by default.
- Authentication context steps up authentication for sensitive resources, and attaches to labels, PIM and apps.
What it is
Granting access is not the end of a Conditional Access decision. Session controls shape what happens after sign in: how long a session lasts, whether access is re checked, and how an app behaves on an unmanaged device. Two more features raise the bar for the most sensitive actions: authentication context, which asks for stronger proof only when a user reaches a sensitive resource, and protected actions, which guard specific administrative operations.
How it works
Session controls
| Control | What it does |
|---|---|
| Sign in frequency | How often a user must sign in again, for example every 8 hours or every day |
| Persistent browser session | Whether a session survives closing the browser, for the "stay signed in" experience |
| Application enforced restrictions | Passes device information to Exchange Online and SharePoint, so they offer a limited experience on unmanaged devices |
| Conditional Access App Control | Routes the session through Microsoft Defender for Cloud Apps for monitoring and session policies |
| Continuous access evaluation | Re checks access during the session, and can be disabled in a policy |
| Token protection | Binds a token to the device it was issued to, to reduce token theft |
| Global Secure Access security profile | Combines network controls from Global Secure Access with the policy |
Sign in frequency and persistent browser work together. A short sign in frequency reduces the time a stolen session is useful. Persistent sessions suit trusted, managed devices, and not public computers.
Device enforced restrictions
Application enforced restrictions are sometimes called device enforced restrictions. For example, with Exchange Online and SharePoint Online, you can allow full access from a compliant device, but a limited browser only experience, without downloads, from an unmanaged device. The app receives the device state from Entra ID and applies the restriction itself.
Continuous access evaluation
Normally an access token is valid for about an hour. Continuous access evaluation (CAE) lets supported services react in near real time to events such as a user being disabled, a password change, a session revocation, or the user moving to a location that policy blocks. The service rejects the token and the client must sign in again. It is enabled by default as part of Conditional Access, and you can disable it in a session control. CAE applies to supported apps, such as Exchange Online, SharePoint Online and Teams.
Authentication context
Authentication context lets an app or a feature ask for stronger authentication only when a user takes a sensitive action, and not for every sign in. You define a context, which has an ID such as c1, and a Conditional Access policy that targets it, for example requiring MFA or a stronger strength. You then attach the context to:
- A sensitivity label in Microsoft Purview, so opening labelled content triggers the step up.
- A Privileged Identity Management role activation.
- Your own application, which requests the context.
For example, a user can browse a SharePoint site normally, but opening a confidential document makes them satisfy a phishing resistant MFA requirement.
Protected actions
Protected actions are permissions that you protect with a Conditional Access policy. When someone tries a protected action, such as deleting Conditional Access policies or changing cross tenant access settings, they must first satisfy the authentication context assigned to that action. This guards the most dangerous administrative operations even if an administrator's session is stolen.
| Step | What you do |
|---|---|
| 1 | Create an authentication context, for example "Require phishing resistant MFA" |
| 2 | Create a Conditional Access policy targeting that context |
| 3 | In Protected actions, add the permission and select the authentication context |
| 4 | The administrator must pass the policy when they use the action |
Choosing the control
| The need | Control |
|---|---|
| Force users to sign in again every 4 hours | Sign in frequency |
| Limited access with no downloads on unmanaged devices | Application enforced restrictions |
| Cut off a leaver's session within minutes | Continuous access evaluation |
| Ask for stronger sign in only when opening labelled content | Authentication context on a sensitivity label |
| Stop admins deleting Conditional Access policies without step up | A protected action |
| Reduce token theft and replay | Token protection |
A worked scenario
A company allows staff to use Exchange and SharePoint from personal phones, but not to download files from them. Application enforced restrictions give personal devices a browser only experience. Administrators have a sign in frequency of eight hours, and the company keeps continuous access evaluation on so that a disabled account loses access within minutes. A sensitivity label for Highly Confidential documents is tied to an authentication context that requires the Phishing resistant MFA strength. Deleting Conditional Access policies and changing cross tenant access settings are protected actions, so even a Global Administrator must pass that context first.
What to remember for the exam
- Session controls include sign in frequency, persistent browser, application enforced restrictions, Conditional Access App Control, CAE and token protection.
- CAE reacts in near real time to events such as disabling an account or revoking a session, and is on by default.
- Authentication context steps up authentication for sensitive resources, and attaches to labels, PIM and apps.
- Protected actions need an authentication context and a Conditional Access policy.
- Application enforced restrictions give limited access on unmanaged devices in Exchange and SharePoint.
"Only when opening sensitive content" is authentication context. "Always, for every sign in" is a normal policy grant control.
How the exam asks about this
- "Limited access, with no downloads, on unmanaged devices." Application enforced restrictions.
- "Which feature applies stronger authentication when a labelled file is opened?" Authentication context.
- "Guard the deletion of Conditional Access policies." A protected action.
- "React within minutes to a user being disabled." Continuous access evaluation.
Common mistakes
Using sign in frequency to end a leaver's session. CAE and revoking sessions are the faster tools.
Creating a protected action without a context policy. The action needs a context and a policy that targets it.
Allowing persistent sessions on shared computers. Limit them to managed devices.
Assuming CAE works with every app. It works with supported services.
Check yourself
What does an authentication context do?
It triggers a stronger Conditional Access requirement only when a user reaches a specific sensitive resource or action.
What must a protected action have assigned?
An authentication context that a Conditional Access policy targets.
What does continuous access evaluation add?
Near real time revocation of access in supported services after events such as disabling an account.
Topic 4 of 6 in Implement Authentication and Access Management
Test yourself on Implement Authentication and Access Management
The full Microsoft SC-300 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.