Contoso uses Microsoft Entra ID with Conditional Access. The security team reports that when they disable a compromised user's account, the user can still access Exchange Online and SharePoint for up to an hour using previously issued access tokens. They want revocation to take effect within minutes without shortening token lifetimes globally or breaking existing sessions for legitimate users. Which capability should you ensure is enabled to address this requirement?