Question

A financial services company is implementing the Zero Trust guiding principle of 'verify explicitly' for its cloud-based SaaS applications accessed via Microsoft Entra ID. Security leadership is concerned that once a user is granted a session token, a compromised or revoked account could continue accessing sensitive applications for hours until the token expires. They want access decisions to react to changes in risk and policy in near-real time without forcing overly short token lifetimes that harm productivity. Which capability should the architect prioritize to best align with the 'verify explicitly' principle in this situation?

Accepted Answer

Enable Continuous Access Evaluation (CAE) so that critical events such as account disablement, password changes, and elevated user risk trigger near-real-time token revocation and re-evaluation

Answer

Reduce the Conditional Access sign-in frequency to require interactive reauthentication every 15 minutes for all sensitive applications

Answer

Configure Entra ID token lifetime policies to issue access tokens with a maximum lifetime of five minutes across all applications

Answer

Deploy a network firewall rule that blocks outbound traffic from any IP address flagged as high risk by threat intelligence feeds