Entra Conditional Access Issue

Question

Entra Conditional Access Issue

Aniket Kuiri 0

Our Outlook add-in relies on the Graph API to fetch emails. Due to customer-side Conditional Access (CA) Policies, we are seeing critical failures where Continuous Access Evaluation (CAE) demands user interaction (InteractionRequired code) to resolve challenges like LocationConditionEvaluationSatisfied or TokenCreatedWithOutdatedPolicies. Since this authentication occurs backend-to-Entra, we lack a frontend mechanism to prompt the required user interaction. Is there a recommended pattern, method, or architectural change that allows our backend to redirect or challenge the user for interactive sign-in, thereby satisfying these CAE requirements and unblocking customers?

Exact error messages:

Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied
Continuous access evaluation resulted in challenge with result: InteractionRequired and code: TokenCreatedWithOutdatedPolicies

Carolyne-3676 1,136 Reputation points

2025-12-02T11:06:03.0833333+00:00
CAE (Continuous Access Evaluation) enforces Conditional Access policies in near real time. When conditions change (e.g., IP mismatch, outdated token policies), Entra ID signals the resource to reject the token—even if it’s still within its lifetime. Backend-only apps cannot satisfy interactive CAE challenges. You need either:

A delegated flow with MSAL to handle claims challenges, or

Policy adjustments for non-interactive scenarios.

Recommended pattern: Hybrid architecture using OBO flow + MSAL for token refresh and claims handling.