Using a Conditional Access policy to revoke or force re-authentication of a compromised Outlook on the web session

SC-200 By islever Editorial Last updated

Respond to alerts and incidents in Microsoft Defender XDR

Short answer

C A Conditional Access policy enforces session controls that revoke or force re-authentication of a compromised OWA session token.

Question

You have a Microsoft 365 subscription that contains the following resources: • 100 users that are assigned a Microsoft 365 E5 license • 100 Windows 11 devices that are joined to the Microsoft Entra tenant The users access their Microsoft Exchange Online mailbox by using Outlook on the web. You need to ensure that if a user account is compromised, the Outlook on the web session token can be revoked. What should you configure?
  1. security defaults in Microsoft Entra
  2. Microsoft Entra Verified ID
  3. a Conditional Access policy in Microsoft Entra Correct Answer
  4. Microsoft Entra ID Protection

Key Takeaways

A Conditional Access policy enforces session controls such as sign-in frequency and can block or require re-authentication when risk is detected, which effectively revokes/invalidates an existing OWA session token; Entra ID Protection only calculates the risk signal.

To ensure a compromised user's Outlook on the web session token can be revoked, configure a Microsoft Entra Conditional Access policy (for example, based on sign-in risk) that can block access or force re-authentication, invalidating the existing session token.

Common mistake: Relying on Entra ID Protection alone — it calculates and surfaces the risk but does not by itself enforce token revocation; a Conditional Access policy is what enforces the session control.

Expert Analysis

Why the Answer Is Correct

A Microsoft Entra Conditional Access policy can enforce session controls such as requiring re-authentication or blocking access when a user is flagged as compromised or shows risky sign-in behavior, which invalidates the existing Outlook on the web session token. This is the mechanism that actually revokes the session.

Why the Other Options Are Wrong

Microsoft Entra ID Protection (D) calculates user and sign-in risk but does not itself enforce token revocation; it must be paired with Conditional Access to act. Security defaults (A) provide baseline protection but no targeted session-revocation control. Verified ID (B) is a decentralized identity feature unrelated to session token revocation.

Community Comment Notes

The community is unanimous (C 100). certinfra (11 likes) explains that ID Protection calculates the risk while Conditional Access enforces the control that revokes/forces re-auth of the session, and 12369b6 and g_man_rap confirm C.

Official Reference

https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview

This link opens the official vendor documentation in a new tab.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. certinfra 👍 11 Answered C
    C is the correct answer. - Microsoft Entra ID Protection calculcates the risk. - A conditional Access policy enforces the access controls and blocks the user based on the calculated risk. ID Protection analyzes signals about user accounts and calculates a risk score based on the probability that the user is compromised. If a user has risky sign-in behavior, or their credentials leak, ID Protection uses these signals to calculate the user risk level. Administrators can configure user risk-based Conditional Access policies to enforce access controls based on user risk, including requirements such as: - Block access See: https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-policies#user-risk-based-conditional-access-policy
  2. 12369b6 👍 1
    Conditional Access policies in Microsoft Entra (formerly Azure AD) allow administrators to enforce specific conditions for access to resources, including revoking session tokens when certain conditions are met. For example, you can configure a Conditional Access policy to require re-authentication or revoke tokens if a user is flagged as compromised or if suspicious activity is detected. Security defaults and Microsoft Entra ID Protection can help secure user identities but do not provide direct control over session token revocation. Microsoft Entra Verified ID is unrelated to token revocation as it deals with decentralized identity verification. https://learn.microsoft.com/en-us/entra/identity-platform/configurable-token-lifetimes?utm_source=perplexity
  3. g_man_rap 👍 1 Answered C
    A Conditional Access policy in Microsoft Entra Conditional Access policies are powerful tools within Microsoft Entra (Azure AD) that allow you to control access based on conditions such as user risk, device state, and more. You can configure policies to block access, require MFA, or force re-authentication under certain conditions. This approach can be used to revoke or invalidate existing session tokens if a specific condition, such as a high-risk sign-in, is detected. This matches the requirement of revoking session tokens in case of a compromised account.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide