Microsoft’s October Entra blog introduces additional device signals for Universal Continuous Access Evaluation (CAE) in Global Secure Access. The extension is marked as public preview. Deleting or disabling a device used for access, or detecting that it is no longer compliant, can trigger reauthentication. For businesses with 10 to 250 workplaces already using Global Secure Access, this creates a practical review task: does a changed device state actually produce the intended access restriction? Detecting an event is not, by itself, an effective blocking policy.
What Universal CAE changes about network access
Global Secure Access uses Entra access tokens to authenticate its tunnels. Microsoft documents a normal token lifetime of 60 to 90 minutes. Universal CAE additionally communicates relevant changes to the service and requests reauthentication before the token would otherwise expire. Applications do not need their own CAE integration when access passes through Global Secure Access. This complements controls in Microsoft Entra ID; it does not replace application permissions or a complete review of the traffic paths involved.
- User signals include disabled accounts and an administrator explicitly revoking refresh tokens.
- High user risk is another documented trigger for reauthentication.
- Device signals for deleted or disabled devices are currently in preview.
- A device becoming noncompliant is also documented as a preview trigger.
Why the corresponding policies still matter
Microsoft explicitly states that device compliance and user risk signals must be used with their corresponding Conditional Access policies. Without those policies, reauthentication can happen silently, leaving no mechanism to act on the CAE event with the intended restriction. This distinction matters: receiving a signal and demonstrating enforcement are different outcomes. Microsoft’s example for internet resources through Global Secure Access requires a compliant device. For high user risk, the documentation gives a policy requiring risk remediation. Reviewing Conditional Access therefore means checking the actual target resource and effective assignments, rather than simply confirming that the client was installed successfully.
Deadlines and proportionate prioritization
The October blog gives no retirement deadline or mandatory migration date for this extension. It does not establish a precise launch day for the device signals either. For an existing GSA environment, we recommend a bounded functional test during the next approved change window, not an immediate organization-wide rollout. This sequence is ReByteIT’s working recommendation, not a Microsoft deadline. Businesses that do not use Global Secure Access should not interpret this announcement as a requirement to introduce it immediately. The task concerns the technical effectiveness of existing access controls, rather than a procurement or licensing recommendation.
Account for supported clients and limitations
Microsoft’s current limitations page lists Universal CAE support only for the Windows client, version 1.8.239.0 or later. Clients on other platforms use regular access tokens. Microsoft also describes Universal CAE as opportunistic by default: if a CAE token cannot be obtained, a regular token can be issued instead. A successful sign-in is therefore not sufficient evidence of CAE protection. Do not promise guaranteed instantaneous disconnection either; Microsoft describes signal delivery time and authentication prompts. Record the observed timing during the pilot and confirm the resulting access restriction. For Private Access, Conditional Access policies target Quick Access or individual GSA applications at application level, rather than applying indiscriminately to the traffic forwarding profile.
Practical next steps for a controlled pilot
For a meaningful test, we recommend a controlled test identity, a test device, and a clearly identified destination. There is no need to change production device objects for this exercise. Before starting, assign responsibility for restoring the initial state and agree which interruption is acceptable during the test.
- Record the client platform, version, and destination connections actually routed through Global Secure Access.
- Document the effective Conditional Access policy, including its target resource, assignments, and exceptions.
- Trigger an agreed device-state change on the test device under controlled conditions, recording the baseline first.
- Observe reauthentication, renewed destination access, and remaining connections; a notification alone is insufficient evidence.
- Record results, timing, and recovery before approving any broader technical change to the environment.
Official Microsoft sources
- Microsoft Entra Blog: What’s new in Microsoft Entra, October 2026
- Microsoft Learn: Universal CAE, triggers, and required policies
- Microsoft Learn: known limitations for Global Secure Access
Our Microsoft Security Assessment can review whether your existing controls connect device state and network access consistently. The focus is technical coverage, demonstrable access outcomes, and a controlled pilot, not licensing advice.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
