When Authorization Changes Before Execution, Who Is Responsible for Validating Authority?

Yes. A workload can retain a valid access token while losing permission for a particular operation because application-specific conditions have changed. The responsibility is shared, with the resource API making the final authorization decision.

Entra establishes identity and evaluates applicable identity policies. The API must validate the access token and enforce the required application roles or delegated scopes, plus access to the specific resource. A previous approval should not replace that resource-level check.

For implementation, load the current resource state, evaluate the operation's authorization requirements, and reject execution when those requirements no longer hold. ASP.NET Core supports this through resource-based authorization with IAuthorizationService.AuthorizeAsync.

Continuous Access Evaluation helps with supported identity changes, but its workload-identity support currently covers Microsoft Graph and eligible single-tenant service principals; managed identities are excluded. It does not automatically enforce your custom business conditions. Test revocation and context changes explicitly.