Re-authentification for SSO users while editing sensitive data [closed]

Prerequisites:

• Application with user data
• Option to register with SSO
• Necessity to re-authenticate the user while modifying sensitive data, lets say email, which can be used to steal the account
• Legacy system with plenty of tech debt

What is the best way to re-authenticate the user?

1. Re-auth user when entering the form with sensitive data regardless of the data they want to modify. Afterwards check if the user was re-authenticated during the last X seconds when modifying the data.
2. Re-auth user when modifying sensitive data - this would require to pipe the form data through different technologies

Any other ideas, or recommendations on how to approach this issue?