When SAML single sign-on is enforced for an organization, what additional step may users face when performing sensitive account or organization actions?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Sensitive actions often trigger a prove-it-is-still-you step — re-auth or SAML confirmation — so a stolen browser session is less useful. That is normal hardened SaaS behavior, not hourly PAT deletion or random team purge. Train helpdesk staff so they do not confuse re-auth prompts with broken SSO.
Full explanation below image
Full Explanation
The correct answer is that users may need to re-authenticate or confirm an elevated session before privileged actions. GitHub uses elevated session / sudo-style challenges and SAML-related re-authentication patterns so that high-impact changes require a fresh proof of identity. Option A is incorrect as standard behavior. Option B is unrelated to SAML enforcement side effects. Option D is incorrect; support tickets are not required for routine re-auth. Admins should ensure IdP session lifetimes and MFA policies align with user experience expectations and document break-glass owner accounts carefully.