Enterprise Identity & Access Management Platform · View 12 of 27 · Runtime

Workforce SSO & Conditional Access

One employee sign-in, including the parts that usually do not happen.

Editable source SVG draw.io All views

Conditional Access is evaluated before a token is issued, so an application that never implemented device compliance still enforces it.
Roughly 71% of sign-ins are silent: an existing primary refresh token already meets the required authentication strength, and steps 8 and 9 are skipped. The design is tuned for that path, not the cold one.
Step 15 is the leaver story. Continuous Access Evaluation carries revocation to CAE-aware resources in about a minute, instead of waiting up to an hour for the access token to expire.

Passkeys and FIDO2 keys are the default method; the Authenticator app is the fallback and SMS is disabled entirely. Phishing-resistant is a requirement for administrators and the target for everyone.
Access tokens live one hour and refresh tokens ninety days with CAE enabled. Shorter access tokens were rejected: they multiply STS load without improving revocation, which CAE already handles.
Temporary Access Pass covers onboarding and key replacement, which removes the last legitimate reason for a helpdesk password reset.

CAE is not supported by every resource provider. Non-CAE resources keep the full one-hour token lifetime, and that residual is accepted and recorded.
Device compliance depends on Intune being available. A compliance-evaluation outage would fail closed for policies that require it — the break-glass path in view 26 exists partly for this.
MFA fatigue attacks are handled by number matching plus the Sentinel detection in view 22, not by user training alone.