A financial services company uses Microsoft 365 and Entra ID. Their security team requires that when a user's account is disabled, their session risk becomes high, or their network location moves outside approved corporate ranges, active access tokens must be invalidated in near real time rather than waiting for the standard token lifetime to expire. The architecture must work for Exchange Online, SharePoint Online, and Microsoft Graph without forcing shorter token lifetimes across the tenant that would degrade user experience. What should the architect design to meet this requirement?