Conditional Access Evaluation is not enabled by default and it cannot it be enabled

[bgavrilMS]

Continuous Access Evaluation (CAE) has 2 parts:

1. Declare the client capable of receiving 401 + WWWAuthenticate requests
2. In case a 401 occurs, extract the claims from the WWWAuthenticate header and re-acquire a token with claims

It seems that part 2 is implemented (see here ) but part1 is not. Clients need to declare themselves CAE capable. In Azure SDK this is done via a boolean property IsCaeEnabled

Recommendation is to enable this by default or to allow the app developer to opt in. Since part 2 is implemented, I recommend enabling it by default.

The impact of enabling this is that the access tokens will automatically become longer lived, around 24h. Id tokens are not affected (also I don't see id tokens used by this sdk).

[baywet]

Hi @bgavrilMS
Thank you for using kiota and for reaching out.
I have authored #322 to address this issue.
The history here is that CAE used to be enabled by default in Azure Identity as far as I can remember, and this was changed recently