Option A needs a time attached, because revoking sessions doesn't stop an access token that was already issued. In Entra ID, for example, Microsoft's revoke-access guidance says that for apps using access tokens the user loses access when the token expires, and the default access token lifetime is a random 60 to 90 minutes. Apps that support Continuous Access Evaluation can cut access off in near real time. The rest can't.
For the exercise, I'd add a column to the decision log: the earliest time the containment actually holds. If sessions are revoked at 09:25, that's up to 10:55 for an app without CAE, and someone has to watch the export logs through that window. It also gives the drill a concrete question: which of our apps honour CAE, and which keep working for another hour and a half?
Thank you, Mike — I appreciate you bringing this important operational detail into the discussion. Recording when containment actually takes effect, and monitoring during the gap, would make the exercise much more useful. Your point about checking which applications support CAE is a valuable addition to the decision log.
Option A needs a time attached, because revoking sessions doesn't stop an access token that was already issued. In Entra ID, for example, Microsoft's revoke-access guidance says that for apps using access tokens the user loses access when the token expires, and the default access token lifetime is a random 60 to 90 minutes. Apps that support Continuous Access Evaluation can cut access off in near real time. The rest can't.
For the exercise, I'd add a column to the decision log: the earliest time the containment actually holds. If sessions are revoked at 09:25, that's up to 10:55 for an app without CAE, and someone has to watch the export logs through that window. It also gives the drill a concrete question: which of our apps honour CAE, and which keep working for another hour and a half?