Entra IDConditional Accesstoken-lifetimecontinuous-access-evaluation
The Malware Is Gone. The Token Still Works. Limiting Token Lifetimes in Entra ID
You evicted the attacker, reset the password, and revoked the sessions. The stolen access token keeps working until it expires. Here is every lever Entra ID gives you to limit token lifetime, Configurable Token Lifetime policies, refresh token hygiene, sign-in frequency, Continuous Access Evaluation, and Token Protection, and exactly what each one buys you.
Rawson Wade15 min read