Contoso wants sign-in tokens for Exchange Online and SharePoint Online to be revoked in near real time when a user's IP address moves outside a defined corporate network range during an active session. They have already enabled continuous access evaluation (CAE) and configured named locations for their corporate IP ranges. However, they notice that when a user's IP changes mid-session, access is not being blocked until the token naturally expires. What must they configure to achieve near-real-time enforcement of the location change?