A hospital IT administrator logs into the billing system from her desk at 8 a.m., badge swiped, laptop on the office network. By 8:40 she has moved to a shared workstation two floors down to cover for a sick colleague, still signed in under the same session. On a growing number of enterprise systems built on Microsoft Entra ID, that switch alone can be enough to trigger a silent re-authentication challenge or a hard session kill, minutes after the fact rather than at the next scheduled token refresh. The login happened once, at 8 a.m. The judgment about whether to keep trusting it never stopped.

The feature behind that is Entra ID's continuous access evaluation, which replaced a model where a stolen access token stayed valid for up to an hour with one that can revoke it within minutes of a risk signal: a location change, a device falling out of compliance, an admin disabling an account elsewhere. Banks have gone further at the behavioral layer. Vendors like BioCatch build a running profile of how a customer types, scrolls, and holds a phone, then score every subsequent screen against that baseline rather than checking identity once at the login page.

The driver is not abstract paranoia. Phishing kits that intercept a live session token — not a password — have become the more dangerous class of attack, because a guessed password can be stopped at the door while a stolen session cookie walks in already trusted. Continuous evaluation is a direct response to that shift: if the theft happens after login, the defense has to live after login too.

For the person being scored, it breaks a comfortable assumption. A new mouse, a red-eye flight, a wrist in a cast — ordinary changes in how someone moves through their own accounts — can read as anomalous to a model trained on a narrower baseline, and the path back from a silently degraded session is rarely as legible as a locked-out password reset with a clear reset button.

It also hands a bank or an employer a running behavioral record of its own customers and staff, generated as a side effect of fraud prevention rather than a deliberate decision anyone consented to in detail. Retention rules for that data, and who can review it later, vary by institution and are rarely published in a form a customer could actually find and read.

The direction of travel is passkeys at the front door — the FIDO Alliance standard now backed by Apple, Google, and Microsoft — paired with continuous behavioral scoring behind it. That combination is probably more resistant to credential theft than anything it replaces.

It is also considerably less legible to the person living inside it. The institutions rolling out continuous evaluation made a bet that a silent kill switch beats a stolen session, and shipped the switch well before building a clear way for the person on the other end of it to ask what the system currently believes about them.