To ensure that a compromised user’s Outlook on the web (OWA) session token can be revoked, you need to use a Conditional Access policy in Microsoft Entra ID (formerly Azure AD). Conditional Access allows you to enforce session control and reauthentication requirements, including immediate sign-out and token revocation when specific conditions are met, such as user risk detection or sign-in risk.

The correct control in this scenario is "Sign-in frequency" or "Require reauthentication" configured in a Conditional Access session policy. This forces the user’s browser-based OWA session token to expire, requiring them to sign in again — effectively revoking the compromised session.

A. Microsoft Entra ID Protection: Detects risky users and sign-ins but doesn’t revoke tokens by itself.

B. Microsoft Entra Verified ID: Used for decentralized identity verification, not for session control.

D. Security defaults: Apply baseline security but do not provide session token revocation granularity.

✅ Answer: C. a Conditional Access policy in Microsoft Entra