ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 22:55 UTC Customize Public modeDiscuss ChangeIntel on Discord

Conditional Access token protection

This page's changes and edits · All guidance changes

Microsoft's edit ·

add-windows-guide

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5d90a38 · +13 −185 lines · also on GitHub

⋯ 19 unchanged lines
2020 When a user registers a Windows 10 or later device with Microsoft Entra, a PRT is issued and cryptographically bound to that device. This binding ensures that even if a threat actor steals a token, it can't be used from another device. With Token Protection enforced, Microsoft Entra validates that only these bound sign-in session tokens are used by supported applications.
2121
2222 > [!NOTE]
23 −> Use Token Protection as part of a broader defense-in-depth strategy against token theft. For more information, see [Protecting tokens in Microsoft Entra](../devices/protecting-tokens-microsoft-entra-id).
23 +> Use Token Protection as part of a broader defense-in-depth strategy against token theft. For more information, see [Protecting tokens in Microsoft Entra](../devices/protecting-tokens-microsoft-entra-id.md).
2424
2525 ## Prerequisites
2626
⋯ 39 unchanged lines
6666 - iOS / iPadOS 14.0 or later. Requires the Microsoft Enterprise SSO plug-in. Only MDM-managed devices are supported.
6767 - For detailed steps on how to setup, see [Enabling Microsoft Enterprise SSO plug-in](../../identity-platform/apple-sso-plugin.md) and configuring [Platform SSO for macOS](/intune/intune-service/configuration/platform-sso-macos).
6868
69 −## Deployment guides
69 +## Deployment
7070
7171 Select the guide for your target platform:
7272
7373 - **Windows**: []()
7474 - **iOS, iPadOS, and macOS**: [Token Protection deployment guide - Apple](deployment-guide-token-protection-apple.md)
7575
76 +For users, the deployment of a Conditional Access policy to enforce token protection should be invisible when using compatible client platforms on registered devices and compatible applications.
7677
78 +To minimize the likelihood of user disruption due to app or device incompatibility, follow these recommendations:
79 +
80 +- Start with a pilot group of users and expand over time.
81 +- Create a Conditional Access policy in [report-only mode](concept-conditional-access-report-only.md) before enforcing token protection.
82 +- Capture both interactive and non-interactive sign-in logs.
83 +- Analyze these logs long enough to cover normal application use.
84 +- Add known, reliable users to an enforcement policy.
85 +
86 +This process helps assess your users’ client and app compatibility for token protection enforcement.
87 +
7788 ### Supported applications
7889
7990 - OneDrive sync client version 22.217 or newer
⋯ 40 unchanged lines
120131 - Power Automate hosted machine groups that are Microsoft Entra joined, you can use `systemLabels -eq "MicrosoftPowerAutomate" and trustType -eq "AzureAD"`.
121132 - Windows Autopilot devices deployed using self-deploying mode, you can use enrollmentProfileName property. As an example, if you have created an enrollment profile in Intune for your Autopilot self-deployment mode devices as "Autopilot self-deployment profile", you can use `enrollmentProfileName -eq "Autopilot self-deployment profile".
122133 - Windows virtual machines in Azure that are Microsoft Entra joined, you can use `profileType -eq "SecureVM" and trustType -eq "AzureAD"`.
123 −
124 −## Deployment
125 −
126 −For users, the deployment of a Conditional Access policy to enforce token protection should be invisible when using compatible client platforms on registered devices and compatible applications.
127 −
128 −To minimize the likelihood of user disruption due to app or device incompatibility, follow these recommendations:
129 −
130 −- Start with a pilot group of users and expand over time.
131 −- Create a Conditional Access policy in [report-only mode](concept-conditional-access-report-only.md) before enforcing token protection.
132 −- Capture both interactive and non-interactive sign-in logs.
133 −- Analyze these logs long enough to cover normal application use.
134 −- Add known, reliable users to an enforcement policy.
135 −
136 −This process helps assess your users’ client and app compatibility for token protection enforcement.
137 −
138 −### Create a Conditional Access policy
139 −
140 −Users who perform specialized roles like those described in [Privileged access security levels](/security/privileged-access-workstations/privileged-access-security-levels#specialized) are possible targets for this functionality. We recommend piloting with a small subset to begin.
141 −
142 −The following steps help you create a Conditional Access policy to require token protection for Exchange Online and SharePoint Online on Windows devices.
143 −
144 −1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator).
145 −1. Browse to **Entra ID** > **Conditional Access** > **Policies**.
146 −1. Select **New policy**.
147 −1. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
148 −1. Under **Assignments**, select **Users or workload identities**.
149 − 1. Under **Include**, select the users or groups who are testing this policy.
150 − 1. Under **Exclude**, select **Users and groups** and choose your organization's emergency access or break-glass accounts.
151 −1. Under **Target resources** > **Resources (formerly cloud apps)** > **Include** > **Select resources**
152 − 1. Under **Select**, select the following applications:
153 − 1. Office 365 Exchange Online
154 − 1. Office 365 SharePoint Online
155 − 1. Microsoft Teams Services
156 − 1. If you deployed Windows App in your environment, include:
157 − 1. Azure Virtual Desktop
158 − 1. Windows 365
159 − 1. Windows Cloud Login
160 −
161 − > [!WARNING]
162 − > Your Conditional Access policy should only be configured for these applications. Selecting the **Office 365** application group might result in unintended failures. This change is an exception to the general rule that the **Office 365** application group should be selected in a Conditional Access policy.
163 −
164 − 1. Choose **Select**.
165 −1. Under **Conditions**:
166 − 1. Under **Device platforms**:
167 − 1. Set **Configure** to **Yes**.
168 − 1. **Include** > **Select device platforms** > **Windows**.
169 − 1. Select **Done**.
170 − 1. Under **Client apps**:
171 − 1. Set **Configure** to **Yes**.
172 −
173 − > [!WARNING]
174 − > Not configuring the **Client Apps** condition, or leaving **Browser** selected might cause applications that use MSAL.js, such as Teams Web to be blocked.
175 −
176 − 1. Under Modern authentication clients, only select **Mobile apps and desktop clients**. Leave other items unchecked.
177 − 1. Select **Done**.
178 −1. Under **Access controls** > **Session**, select **Require token protection for sign-in sessions** and select **Select**.
179 −1. Confirm your settings and set **Enable policy** to **Report-only**.
180 −1. Select create to enable your policy.
181 −
182 −[!INCLUDE [conditional-access-report-only-mode](../../includes/conditional-access-report-only-mode.md)]
183 −
184 −> [!TIP]
185 −> Since Conditional Access policies requiring token protection are currently only available for Windows devices, it's necessary to secure your environment against potential policy bypass when an attacker might appear to come from a different platform.
186 −>
187 −> In addition, you should configure the following policies:
188 −>
189 −> - [Block access from unknown platforms](policy-all-users-device-unknown-unsupported.md)
190 −> - [Require device compliance for all known platforms](policy-all-users-device-compliance.md)
191 −
192 −### Capture logs and analyze
193 −
194 −Monitor Conditional Access enforcement of token protection before and after enforcement by using features like [Policy impact](concept-conditional-access-report-only.md#policy-impact), [Sign-in logs](#sign-in-logs), and [Log Analytics](#log-analytics).
195 −
196 −#### Sign-in logs
197 −
198 −Use Microsoft Entra sign-in log to verify the outcome of a token protection enforcement policy in report only mode or in enabled mode.
199 −
200 −:::image type="content" source="media/concept-token-protection/sign-in-log-sample.png" alt-text="Screenshot showing an example of a policy not being satisfied." lightbox="media/concept-token-protection/sign-in-log-sample.png":::
201 −
202 −1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator).
203 −1. Browse to **Entra ID** > **Monitoring & health** > **Sign-in logs**.
204 −1. Select a specific request to determine if the policy is applied or not.
205 −1. Go to the **Conditional Access** or **Report-Only** pane depending on its state and select the name of your policy requiring token protection.
206 −1. Under **Session Controls** check to see if the policy requirements were satisfied or not.
207 −1. To find more details about the binding state of the request, select the pane **Basic Info** and see the field **Token Protection - Sign In Session**. Possible values are:
208 − 1. Bound: the request was using bound protocols. Some sign-ins might include multiple requests, and all requests must be bound to satisfy the token protection policy. Even if an individual request appears to be bound, it doesn't ensure compliance with the policy if other requests are unbound. To see all requests for a sign-in, you can filter all requests for a specific user or look by corelationid.
209 − 1. Unbound: the request wasn't using bound protocols. Possible `statusCodes` when request is unbound are:
210 − 1. 1002: The request is unbound due to the lack of Microsoft Entra ID device state.
211 − 1. 1003: The request is unbound because the Microsoft Entra ID device state doesn't satisfy Conditional Access policy requirements for token protection. This error could be due to an unsupported device registration type, or the device wasn't registered using fresh sign-in credentials.
212 − 1. 1005: The request is unbound for other unspecified reasons.
213 − 1. 1006: The request is unbound because the OS version is unsupported.
214 − 1. 1008: The request is unbound because the client isn't integrated with the platform broker, such as Windows Account Manager (WAM).
215 −
216 −:::image type="content" source="media/concept-token-protection/sign-in-log-sample-unbound-status-code-1002.png" alt-text="Screenshot showing a sample sign-in with the Token Protection - Sign In Session attribute highlighted. " lightbox="media/concept-token-protection/sign-in-log-sample-unbound-status-code-1002.png":::
217 −
218 −#### Log Analytics
219 −
220 −You can also use [Log Analytics](~/identity/monitoring-health/tutorial-configure-log-analytics-workspace.md) to query the sign-in logs (interactive and non-interactive) for blocked requests due to token protection enforcement failure.
221 −
222 −Here's a sample Log Analytics query searching the non-interactive sign-in logs for the last seven days, highlighting **Blocked** versus **Allowed** requests by **Application**. These queries are only samples and are subject to change.
223 −
224 −> [!NOTE]
225 −> **Sign In logs output:** The value of the string used in "enforcedSessionControls" and "sessionControlsNotSatisfied" changed from "Binding" to "SignInTokenProtection" in late June 2023. Queries on Sign In Log data should be updated to reflect this change. The examples cover both values to include historical data.
226 −
227 −```kusto
228 −//Per Apps query
229 −// Select the log you want to query (SigninLogs or AADNonInteractiveUserSignInLogs )
230 −//SigninLogs
231 −AADNonInteractiveUserSignInLogs
232 −// Adjust the time range below
233 −| where TimeGenerated > ago(7d)
234 −| project Id,ConditionalAccessPolicies, Status,UserPrincipalName, AppDisplayName, ResourceDisplayName
235 −| where ConditionalAccessPolicies != "[]"
236 −| where ResourceDisplayName == "Office 365 Exchange Online" or ResourceDisplayName =="Office 365 SharePoint Online" or ResourceDisplayName =="Azure Virtual Desktop" or ResourceDisplayName =="Windows 365" or ResourceDisplayName =="Windows Cloud Login"
237 −| where ResourceDisplayName == "Office 365 Exchange Online" or ResourceDisplayName =="Office 365 SharePoint Online"
238 −//Add userPrincipalName if you want to filter
239 −// | where UserPrincipalName =="<user_principal_Name>"
240 −| mv-expand todynamic(ConditionalAccessPolicies)
241 −| where ConditionalAccessPolicies ["enforcedSessionControls"] contains '["Binding"]' or ConditionalAccessPolicies ["enforcedSessionControls"] contains '["SignInTokenProtection"]'
242 −| where ConditionalAccessPolicies.result !="reportOnlyNotApplied" and ConditionalAccessPolicies.result !="notApplied"
243 −| extend SessionNotSatisfyResult = ConditionalAccessPolicies["sessionControlsNotSatisfied"]
244 −| extend Result = case (SessionNotSatisfyResult contains 'SignInTokenProtection' or SessionNotSatisfyResult contains 'SignInTokenProtection', 'Block','Allow')
245 −| summarize by Id,UserPrincipalName, AppDisplayName, Result
246 −| summarize Requests = count(), Users = dcount(UserPrincipalName), Block = countif(Result == "Block"), Allow = countif(Result == "Allow"), BlockedUsers = dcountif(UserPrincipalName, Result == "Block") by AppDisplayName
247 −| extend PctAllowed = round(100.0 * Allow/(Allow+Block), 2)
248 −| sort by Requests desc
249 −```
250 −
251 −The result of the previous query should be similar to the following screenshot:
252 −
253 −:::image type="content" source="media/concept-token-protection/log-analytics-results.png" alt-text="Screenshot showing example results of a Log Analytics query looking for token protection policies" lightbox="media/concept-token-protection/log-analytics-results.png":::
254 −
255 −The following query example looks at the non-interactive sign-in log for the last seven days, highlighting **Blocked** versus **Allowed** requests by **User**.
256 −
257 −```kusto
258 −//Per users query
259 −// Select the log you want to query (SigninLogs or AADNonInteractiveUserSignInLogs )
260 −//SigninLogs
261 −AADNonInteractiveUserSignInLogs
262 −// Adjust the time range below
263 −| where TimeGenerated > ago(7d)
264 −| project Id,ConditionalAccessPolicies, UserPrincipalName, AppDisplayName, ResourceDisplayName
265 −| where ConditionalAccessPolicies != "[]"
266 −| where ResourceDisplayName == "Office 365 Exchange Online" or ResourceDisplayName =="Office 365 SharePoint Online" or ResourceDisplayName =="Azure Virtual Desktop" or ResourceDisplayName =="Windows 365" or ResourceDisplayName =="Windows Cloud Login"
267 −| where ResourceDisplayName == "Office 365 Exchange Online" or ResourceDisplayName =="Office 365 SharePoint Online"
268 −//Add userPrincipalName if you want to filter
269 −// | where UserPrincipalName =="<user_principal_Name>"
270 −| mv-expand todynamic(ConditionalAccessPolicies)
271 −| where ConditionalAccessPolicies ["enforcedSessionControls"] contains '["Binding"]' or ConditionalAccessPolicies ["enforcedSessionControls"] contains '["SignInTokenProtection"]'
272 −| where ConditionalAccessPolicies.result !="reportOnlyNotApplied" and ConditionalAccessPolicies.result !="notApplied"
273 −| extend SessionNotSatisfyResult = ConditionalAccessPolicies.sessionControlsNotSatisfied
274 −| extend Result = case (SessionNotSatisfyResult contains 'SignInTokenProtection' or SessionNotSatisfyResult contains 'SignInTokenProtection', 'Block','Allow')
275 −| summarize by Id, UserPrincipalName, AppDisplayName, ResourceDisplayName,Result
276 −| summarize Requests = count(),Block = countif(Result == "Block"), Allow = countif(Result == "Allow") by UserPrincipalName, AppDisplayName,ResourceDisplayName
277 −| extend PctAllowed = round(100.0 * Allow/(Allow+Block), 2)
278 −| sort by UserPrincipalName asc
279 −```
280 −
281 −The following query example looks at the non-interactive sign-in log for the last seven days, highlighting users that are using devices, where Microsoft Entra ID device state doesn't satisfy Token protection CA policy requirements.
282 −
283 −```kusto
284 −AADNonInteractiveUserSignInLogs
285 −// Adjust the time range below
286 −| where TimeGenerated > ago(7d)
287 −| where TokenProtectionStatusDetails!= ""
288 −| extend parsedBindingDetails = parse_json(TokenProtectionStatusDetails)
289 −| extend bindingStatus = tostring(parsedBindingDetails["signInSessionStatus"])
290 −| extend bindingStatusCode = tostring(parsedBindingDetails["signInSessionStatusCode"])
291 −| where bindingStatusCode == 1003
292 −| summarize count() by UserPrincipalName
293 −```
294 −
295 −### End user experience
296 −
297 −A user that registered or enrolled their supported device doesn't experience any differences in the sign in experience on a token protection supported application when the token protection requirement is enabled.
298 −
299 −A user who hasn't registered or enrolled their device and if the token protection policy is enabled sees the following screenshot after authenticating.
300 −
301 −:::image type="content" source="media/concept-token-protection/token-protection-register-or-enroll-device.png" alt-text="Screenshot of the token protection error message when your device isn't registered or enrolled.":::
302 −
303 −A user that isn't using a supported application when the token protection policy is enabled will see the following screenshot after authenticating.
304 −
305 −:::image type="content" source="media/concept-token-protection/token-protection-required-error-message.png" alt-text="Screenshot of the error message when a token protection policy blocks access.":::
306134
307135 ## Related content
308136
⋯ 1 unchanged line

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:13 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 22:55 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.