Work through CAE session revocation, IP location evidence, authentication context, privileged protected actions and safe policy template rollout in two Northstar incidents plus a five-stage session-control investigation.
Two Northstar incidents investigate lingering access after critical events and targeted step-up for sensitive sites and admin operations. Correct, evidence-led decisions advance each incident.
Northstar disables a compromised account during a live Microsoft 365 session. The security team needs reliable evidence without assuming every token disappears immediately.
The policy exists. Prove the user, client and resource behaved as intended before signing off the change.
0 of 5 decisions validated · simulated browser-only exercise · resets on reloadConfigure a scoped Northstar session policy, run report-only evidence, then switch it On and test both intended and excluded clients. This models explicit Entra evaluation points; it cannot predict every real application's cookie or token behavior.
Browser-only simulation · Existing Practice 018 progress is unchangedNorthstar wants one-hour reauthentication and no persistent Entra browser session for unmanaged pilot devices while retaining emergency access.
Never-persistent browser sessions require the correct resource targeting. Use a scoped device condition and a controlled pilot; a report-only policy collects projected decisions rather than enforcing prompts.
Run the unmanaged pilot's 90-minute sign-in evaluation before enabling the policy.
A projected User action required does not prove that report-only challenged the user. In production, inspect policy details and observed sign-ins before changing the policy to On.
Switch the configured policy to On, run all six independent checks, and verify that a native client without an Entra re-evaluation doesn't receive an invented instant prompt.
Finance browser reaches a new Entra authentication evaluation after 90 minutes.
An unmanaged pilot browser has restarted and the application redirects back to Entra.
A pilot employee uses an approved managed device.
A cloud-only emergency account attempts recovery sign-in.
A participating native app hasn't asked Entra to evaluate its session again.
An unassigned employee requests Finance through an unmanaged browser.
0/6 checks match the intended outcome · Report-only: not verified · Safe enforced scope: not yet
Review the advanced CA guide or revisit the complete SC-300 objective map before the next security scenario.
