Conditional Access token protection
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 354aed4 · +2 −0 lines · also on GitHub
⋯ 14 unchanged lines
1515
---
1616
# Token Protection in Microsoft Entra Conditional Access
1717
18
+## Overview
19
+
1820
Token Protection is a Conditional Access session control that attempts to reduce token replay attacks by ensuring only device bound sign-in session tokens, like [Primary Refresh Tokens (PRTs)](../devices/concept-primary-refresh-token.md), are accepted by Microsoft Entra ID when applications request access to protected resources.
1921
2022
When a user registers a supported device with Microsoft Entra, a PRT is issued and cryptographically bound to that device. This binding ensures that even if a threat actor steals the token, it can't be used from another device. With Token Protection enforced, Microsoft Entra validates that only these bound sign-in session tokens are used by supported applications.
⋯ 62 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:13 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.