When SAML single sign-on is enforced for an organization, what additional step may users face when performing sensitive account or organization actions?
Select an answer to reveal the explanation.
Short Explanation
Sensitive actions often trigger a prove-it-is-still-you step — re-auth or SAML confirmation — so a stolen browser session is less useful. That is normal hardened SaaS behavior, not hourly PAT deletion or random team purge. Train helpdesk staff so they do not confuse re-auth prompts with broken SSO.
Full Explanation
The correct answer is that users may need to re-authenticate or confirm an elevated session before privileged actions. GitHub uses elevated session / sudo-style challenges and SAML-related re-authentication patterns so that high-impact changes require a fresh proof of identity. Option A is incorrect as standard behavior. Option B is unrelated to SAML enforcement side effects. Option D is incorrect; support tickets are not required for routine re-auth. Admins should ensure IdP session lifetimes and MFA policies align with user experience expectations and document break-glass owner accounts carefully.