Question

A financial services company uses Entra ID for workforce identity. The security architect must design an access policy that meets three requirements: (1) when a user's sign-in is scored high risk during an active session, access must be re-evaluated and revoked without waiting for token expiry; (2) tokens must be bound to the device that requested them so a stolen refresh token cannot be replayed from another device; and (3) users flagged as high user-risk must be forced to securely reset their password before regaining access. Which combination of Entra capabilities should the architect specify?

Accepted Answer

Continuous Access Evaluation for session revocation, token protection (token binding) in Conditional Access, and a user-risk policy requiring secure password change

Answer

Sign-in frequency set to 1 hour, Conditional Access session controls with app-enforced restrictions, and a sign-in-risk policy requiring MFA

Answer

Continuous Access Evaluation for session revocation, Global Secure Access compliant network check, and a sign-in-risk policy requiring MFA

Answer

Token lifetime configuration policy, Conditional Access requiring hybrid Entra joined devices, and an authentication strength policy requiring phishing-resistant MFA