Continuous access evaluation for the provider

[eduardodfmex]

Description

Continuous access evaluation

Token expiration and refresh are a standard mechanism in the industry. When a client application like Outlook connects to a service like Exchange Online, the API requests are authorized using OAuth 2.0 access tokens. By default, access tokens are valid for one hour, when they expire the client is redirected to Microsoft Entra to refresh them. That refresh period provides an opportunity to reevaluate policies for user access. For example: we might choose not to refresh the token because of a Conditional Access policy, or because the user is disabled in the directory.

The mechanism for this conversation is continuous access evaluation (CAE), an industry standard based on Open ID Continuous Access Evaluation Profile (CAEP). The goal for critical event evaluation is for response to be near real time, but latency of up to 15 minutes might be observed because of event propagation time; however, IP locations policy enforcement is instant.

To prepare your applications to use CAE, see How to use Continuous Access Evaluation enabled APIs in your applications.

Authentication improvement

• Auth powerplatform and entra with _[ Continuous access evaluation]
• Continuous access evaluation: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-continuous-access-evaluation
• Estimated complexity/effort: medium we need to spike on it.

Key benefits

• User termination or password change/reset: User session revocation is enforced in near real time.

• Network location change: Conditional Access location policies are enforced in near real time.

• Token export to a machine outside of a trusted network can be prevented with Conditional Access location policies.

Note

This could be an Entra configuration if that is the case we can create the documentation that apply for the provider.

Definition of Done

• Auth Implementation
• Unit Tests for Happy Path (if apply)
• Unit Tests for error path (if apply)
• Acceptance Tests (if apply)
• Example in the /examples folder
• Schema Documentation in code
• Updated auto-generated provider docs with make docs

Contributions

Do you plan to raise a PR to address this issue? YES / NO?

See the contributing guide for more information about what's expected for contributions.