How long until an Entra change applies?

Leaving an allowed IP range: instant

In a session with continuous access evaluation (CAE), Exchange Online, SharePoint Online and Teams evaluate key Conditional Access policies themselves, and IP location enforcement is instant. It covers IP-based named locations only: CAE has no insight into country or region locations or MFA trusted IPs. If Microsoft Entra still sees an allowed IP while the service sees one outside the range, as split tunnels and proxies can cause, Entra issues a one-hour token that suspends the IP check at the service until it expires. Teams calls and chat don't follow IP-based Conditional Access policies at all. Microsoft's continuous access evaluation page

A critical event: up to 15 minutes

CAE services subscribe to five critical events: a user deleted or disabled, a password changed or reset, MFA turned on for the user, an admin revoking all of a user's refresh tokens, and high user risk from Microsoft Entra ID Protection. Microsoft aims for near real time, with up to 15 minutes of propagation.

Re-enabled after a disable: 15 to 40 minutes

A user enabled right after being disabled isn't recognized at once downstream: SharePoint Online and Teams typically take 15 minutes, Exchange Online 35 to 40.

An access token without CAE: 60 to 90 minutes

Without CAE, a client keeps using its access token until it expires. By default the Microsoft identity platform gives each one a random lifetime between 60 and 90 minutes, 75 on average. Tenants that don't use Conditional Access get a two-hour default for clients such as Microsoft Teams and Microsoft 365. Microsoft's access token page

A policy or group change: up to a day

Changes to Conditional Access policies and group membership can take up to a day to take effect, because they replicate from Microsoft Entra to services like Exchange Online and SharePoint Online. Some policy updates arrive in about two hours, though not yet in every scenario.

A token in a CAE session: up to 28 hours

Because CAE services act on events and policy as they happen, their access tokens are long-lived, up to 28 hours, and configurable token lifetime policies aren't honored for them. A critical event, or the service's own evaluation of a synchronized Conditional Access policy, ends access sooner. Two limits: CAE doesn't support guest accounts, and once the IP ranges in location policies pass 5,000 in total, it can't enforce a location change in real time.

To apply a change now

Revoke the user's sessions: run Revoke-MgUserSignInSession, which revokes all of the user's refresh tokens, or select Revoke Session on the user's profile page so the updated policies apply immediately.

The authentication chapter of the SC-300 Microsoft Identity and Access Administrator Complete Exam Guide carries CAE's critical events, its location limits and the revoke command. The card below links it.