Using a Conditional Access policy to revoke or force re-authentication of a compromised Outlook on the web session

Respond to alerts and incidents in Microsoft Defender XDR
Answer Correct answer: C — A Conditional Access policy enforces session controls that revoke or force re-authentication of a compromised OWA session token.

You have a Microsoft 365 subscription that contains the following resources: • 100 users that are assigned a Microsoft 365 E5 license • 100 Windows 11 devices that are joined to the Microsoft Entra tenant The users access their Microsoft Exchange Online mailbox by using Outlook on the web. You need to ensure that if a user account is compromised, the Outlook on the web session token can be revoked. What should you configure?

  1. security defaults in Microsoft Entra
  2. Microsoft Entra Verified ID
  3. a Conditional Access policy in Microsoft Entra Correct Answer
  4. Microsoft Entra ID Protection
conditional access session revocation compromised account token entra conditional access

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

A Conditional Access policy enforces session controls such as sign-in frequency and can block or require re-authentication when risk is detected, which effectively revokes/invalidates an existing OWA session token; Entra ID Protection only calculates the risk signal.

To ensure a compromised user's Outlook on the web session token can be revoked, configure a Microsoft Entra Conditional Access policy (for example, based on sign-in risk) that can block access or force re-authentication, invalidating the existing session token.

Relying on Entra ID Protection alone — it calculates and surfaces the risk but does not by itself enforce token revocation; a Conditional Access policy is what enforces the session control.

Community Discussion (3 comments)

certinfra 👍 11 Selected: C
C is the correct answer. - Microsoft Entra ID Protection calculcates the risk. - A conditional Access policy enforces the access controls and blocks the user based on the calculated risk. ID Protection analyzes signals about user accounts and calculates a risk score based on the probability that the user is compromised. If a user has risky sign-in behavior, or their credentials leak, ID Protection uses these signals to calculate the user risk level. Administrators can configure user risk-based Conditional Access policies to enforce access controls based on user risk, including requirements such as: - Block access See: https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-policies#user-risk-based-conditional-access-policy
12369b6 👍 1
Conditional Access policies in Microsoft Entra (formerly Azure AD) allow administrators to enforce specific conditions for access to resources, including revoking session tokens when certain conditions are met. For example, you can configure a Conditional Access policy to require re-authentication or revoke tokens if a user is flagged as compromised or if suspicious activity is detected. Security defaults and Microsoft Entra ID Protection can help secure user identities but do not provide direct control over session token revocation. Microsoft Entra Verified ID is unrelated to token revocation as it deals with decentralized identity verification. https://learn.microsoft.com/en-us/entra/identity-platform/configurable-token-lifetimes?utm_source=perplexity
g_man_rap 👍 1 Selected: C
A Conditional Access policy in Microsoft Entra Conditional Access policies are powerful tools within Microsoft Entra (Azure AD) that allow you to control access based on conditions such as user risk, device state, and more. You can configure policies to block access, require MFA, or force re-authentication under certain conditions. This approach can be used to revoke or invalidate existing session tokens if a specific condition, such as a high-risk sign-in, is detected. This matches the requirement of revoking session tokens in case of a compromised account.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

A Microsoft Entra Conditional Access policy can enforce session controls such as requiring re-authentication or blocking access when a user is flagged as compromised or shows risky sign-in behavior, which invalidates the existing Outlook on the web session token. This is the mechanism that actually revokes the session.

Why the Other Options Are Wrong

Microsoft Entra ID Protection (D) calculates user and sign-in risk but does not itself enforce token revocation; it must be paired with Conditional Access to act. Security defaults (A) provide baseline protection but no targeted session-revocation control. Verified ID (B) is a decentralized identity feature unrelated to session token revocation.

Community Comment Notes

The community is unanimous (C 100). certinfra (11 likes) explains that ID Protection calculates the risk while Conditional Access enforces the control that revokes/forces re-auth of the session, and 12369b6 and g_man_rap confirm C.

Official Reference

https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview

Related Analysis

You have a Microsoft 365 subscription that uses Microsoft De

S-Grade

You have 500 on-premises devices. You have a Microsoft 365 E

S-Grade

You have an Azure subscription named Sub1 that uses Microsof

A-Grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide