A development team integrating a custom client against Exchange Online reports that the client behaves unpredictably during token revocation tests, and they need to temporarily stop continuous access evaluation from applying to that one application so they can isolate whether their token handling is the cause. Which Conditional Access setting lets the administrator turn off continuous access evaluation for just that application?
- AWithin a Conditional Access policy scoped to the application, use the Customize continuous access evaluation session control and set it to Disable. Correct
- BLower the application's access token lifetime to a few minutes through a token lifetime policy so revocation events no longer matter during the test.
- CRemove the application from all Conditional Access policies so continuous access evaluation has no policy to evaluate against for it.
- DDisable security defaults for the tenant so continuous access evaluation stops being enforced on the application's sessions.
Why A is correct: The Customize continuous access evaluation session control, set to Disable in a policy scoped to that app, switches continuous access evaluation off for those sessions, which is the supported way to isolate the behaviour for troubleshooting.
Why B is wrong: Shortening the token lifetime changes token duration but leaves continuous access evaluation active, so revocation events still fire and the team cannot cleanly isolate whether their own token handling is at fault.
Why C is wrong: Removing the app from Conditional Access also drops every other grant and session control protecting it, and continuous access evaluation can still operate independently of policy scope, so this neither targets the feature nor is safe.
Why D is wrong: Security defaults are a separate baseline that does not govern continuous access evaluation, and turning them off would weaken tenant-wide protection without affecting the per-app continuous access evaluation behaviour being tested.