Microsoft's edit · Conditional Access token protection

44 ms.service: entra-id

55 ms.subservice: conditional-access

66 ms.topic: concept-article

7 −ms.date: 03/03/2026

7 +ms.date: 02/24/2026

88 ms.reviewer: sgrandhi

99 ms.custom:

1010 - sfi-image-nochange

3131 | macOS | Preview |

3232

3333 > [!NOTE]

34 −> Token Protection currently supports native applications only. Browser-based applications aren't supported.

34 +> Token Protection currently supports native applications only. Browser-based applications are not supported.

3535

3636 ## Supported resources

3737

5454 - For detailed steps on how to register your device, see [Register your personal device on your work or school network](https://support.microsoft.com/account-billing/register-your-personal-device-on-your-work-or-school-network-8803dd61-a613-45e3-ae6c-bd1ab25bf8a8).

5555

5656 **Apple (Preview)**:

57 −- macOS 11.0 or later. Requires the Microsoft Enterprise single-sign-on (SSO) plug-in. Alternatively, you can also use Platform SSO. Only MDM-managed devices are supported.

57 +- macOS 11.0 or later. Requires the Microsoft Enterprise SSO plug-in. Alternatively, you can also use Platform SSO. Only MDM-managed devices are supported.

5858 - iOS / iPadOS 14.0 or later. Requires the Microsoft Enterprise SSO plug-in. Only MDM-managed devices are supported.

59 −- For detailed steps on how to set up, see [Enabling Microsoft Enterprise SSO plug-in](../../identity-platform/apple-sso-plugin.md) and configuring [Platform SSO for macOS](/intune/intune-service/configuration/platform-sso-macos).

59 +- For detailed steps on how to setup, see [Enabling Microsoft Enterprise SSO plug-in](../../identity-platform/apple-sso-plugin.md) and configuring [Platform SSO for macOS](/intune/intune-service/configuration/platform-sso-macos).

6060

6161 ## Deployment

6262

6868 - Analyze these logs long enough to cover normal application use.

6969 - Add known, reliable users to an enforcement policy.

7070

71 −This process helps assess your users’ client and app compatibility for token protection enforcement.

72 −

73 −### Create a Conditional Access policy

74 −

75 −Users who perform specialized roles like those described in [Privileged access security levels](/security/privileged-access-workstations/privileged-access-security-levels#specialized) are possible targets for this functionality. We recommend piloting with a small subset to begin.

76 −

77 −The following steps help you create a Conditional Access policy to require token protection for Exchange Online and SharePoint Online on Windows devices.

78 −

79 −1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator).

80 −1. Browse to **Entra ID** > **Conditional Access** > **Policies**.

81 −1. Select **New policy**.

82 −1. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.

83 −1. Under **Assignments**, select **Users or workload identities**.

84 − 1. Under **Include**, select the users or groups who are testing this policy.

85 − 1. Under **Exclude**, select **Users and groups** and choose your organization's emergency access or break-glass accounts.

86 −1. Under **Target resources** > **Resources (formerly cloud apps)** > **Include** > **Select resources**

87 − 1. Under **Select**, select the following applications:

88 − 1. Office 365 Exchange Online

89 − 1. Office 365 SharePoint Online

90 − 1. Microsoft Teams Services

91 − 1. If you deployed Windows App in your environment, include:

92 − 1. Azure Virtual Desktop

93 − 1. Windows 365

94 − 1. Windows Cloud Login

95 −

96 − > [!WARNING]

97 − > Your Conditional Access policy should only be configured for these applications. Selecting the **Office 365** application group might result in unintended failures. This change is an exception to the general rule that the **Office 365** application group should be selected in a Conditional Access policy.

98 −

99 − 1. Choose **Select**.

100 −1. Under **Conditions**:

101 − 1. Under **Device platforms**:

102 − 1. Set **Configure** to **Yes**.

103 − 1. **Include** > **Select device platforms** > **Windows**.

104 − 1. Select **Done**.

105 − 1. Under **Client apps**:

106 − 1. Set **Configure** to **Yes**.

107 −

108 − > [!WARNING]

109 − > Not configuring the **Client Apps** condition, or leaving **Browser** selected might cause applications that use MSAL.js, such as Teams Web to be blocked.

110 −

111 − 1. Under Modern authentication clients, only select **Mobile apps and desktop clients**. Leave other items unchecked.

112 − 1. Select **Done**.

113 −1. Under **Access controls** > **Session**, select **Require token protection for sign-in sessions** and select **Select**.

114 −1. Confirm your settings and set **Enable policy** to **Report-only**.

115 −1. Select create to enable your policy.

116 −

117 −[!INCLUDE [conditional-access-report-only-mode](../../includes/conditional-access-report-only-mode.md)]

118 −

119 −> [!TIP]

120 −> Since Conditional Access policies requiring token protection are currently only available for Windows devices, it's necessary to secure your environment against potential policy bypass when an attacker might appear to come from a different platform.

121 −>

122 −> In addition, you should configure the following policies:

123 −>

124 −> - [Block access from unknown platforms](policy-all-users-device-unknown-unsupported.md)

125 −> - [Require device compliance for all known platforms](policy-all-users-device-compliance.md)

126 −

127 −### Capture logs and analyze

128 −

129 −Monitor Conditional Access enforcement of token protection before and after enforcement by using features like [Policy impact](concept-conditional-access-report-only.md#policy-impact), [Sign-in logs](#sign-in-logs), and [Log Analytics](#log-analytics).

130 −

131 −#### Sign-in logs

132 −

133 −Use Microsoft Entra sign-in log to verify the outcome of a token protection enforcement policy in report only mode or in enabled mode.

134 −

135 −:::image type="content" source="media/concept-token-protection/sign-in-log-sample.png" alt-text="Screenshot showing an example of a policy not being satisfied." lightbox="media/concept-token-protection/sign-in-log-sample.png":::

136 −

137 −1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator).

138 −1. Browse to **Entra ID** > **Monitoring & health** > **Sign-in logs**.

139 −1. Select a specific request to determine if the policy is applied or not.

140 −1. Go to the **Conditional Access** or **Report-Only** pane depending on its state and select the name of your policy requiring token protection.

141 −1. Under **Session Controls** check to see if the policy requirements were satisfied or not.

142 −1. To find more details about the binding state of the request, select the pane **Basic Info** and see the field **Token Protection - Sign In Session**. Possible values are:

143 − 1. Bound: the request was using bound protocols. Some sign-ins might include multiple requests, and all requests must be bound to satisfy the token protection policy. Even if an individual request appears to be bound, it doesn't ensure compliance with the policy if other requests are unbound. To see all requests for a sign-in, you can filter all requests for a specific user or look by corelationid.

144 − 1. Unbound: the request wasn't using bound protocols. Possible `statusCodes` when request is unbound are:

145 − 1. 1002: The request is unbound due to the lack of Microsoft Entra ID device state.

146 − 1. 1003: The request is unbound because the Microsoft Entra ID device state doesn't satisfy Conditional Access policy requirements for token protection. This error could be due to an unsupported device registration type, or the device wasn't registered using fresh sign-in credentials.

147 − 1. 1005: The request is unbound for other unspecified reasons.

148 − 1. 1006: The request is unbound because the OS version is unsupported.

149 − 1. 1008: The request is unbound because the client isn't integrated with the platform broker, such as Windows Account Manager (WAM).

150 −

151 −:::image type="content" source="media/concept-token-protection/sign-in-log-sample-unbound-status-code-1002.png" alt-text="Screenshot showing a sample sign-in with the Token Protection - Sign In Session attribute highlighted. " lightbox="media/concept-token-protection/sign-in-log-sample-unbound-status-code-1002.png":::

152 −

153 −#### Log Analytics

154 −

155 −You can also use [Log Analytics](~/identity/monitoring-health/tutorial-configure-log-analytics-workspace.md) to query the sign-in logs (interactive and non-interactive) for blocked requests due to token protection enforcement failure.

156 −

157 −Here's a sample Log Analytics query searching the non-interactive sign-in logs for the last seven days, highlighting **Blocked** versus **Allowed** requests by **Application**. These queries are only samples and are subject to change.

158 −

159 −> [!NOTE]

160 −> **Sign In logs output:** The value of the string used in "enforcedSessionControls" and "sessionControlsNotSatisfied" changed from "Binding" to "SignInTokenProtection" in late June 2023. Queries on Sign In Log data should be updated to reflect this change. The examples cover both values to include historical data.

161 −

162 −```kusto

163 −//Per Apps query

164 −// Select the log you want to query (SigninLogs or AADNonInteractiveUserSignInLogs )

165 −//SigninLogs

166 −AADNonInteractiveUserSignInLogs

167 −// Adjust the time range below

168 −| where TimeGenerated > ago(7d)

169 −| project Id,ConditionalAccessPolicies, Status,UserPrincipalName, AppDisplayName, ResourceDisplayName

170 −| where ConditionalAccessPolicies != "[]"

171 −| where ResourceDisplayName == "Office 365 Exchange Online" or ResourceDisplayName =="Office 365 SharePoint Online" or ResourceDisplayName =="Azure Virtual Desktop" or ResourceDisplayName =="Windows 365" or ResourceDisplayName =="Windows Cloud Login"

172 −//Add userPrincipalName if you want to filter

173 −// | where UserPrincipalName =="<user_principal_Name>"

174 −| mv-expand todynamic(ConditionalAccessPolicies)

175 −| where ConditionalAccessPolicies ["enforcedSessionControls"] contains '["Binding"]' or ConditionalAccessPolicies ["enforcedSessionControls"] contains '["SignInTokenProtection"]'

176 −| where ConditionalAccessPolicies.result !="reportOnlyNotApplied" and ConditionalAccessPolicies.result !="notApplied"

177 −| extend SessionNotSatisfyResult = ConditionalAccessPolicies["sessionControlsNotSatisfied"]

178 −| extend Result = case (SessionNotSatisfyResult contains 'SignInTokenProtection' or SessionNotSatisfyResult contains 'Binding', 'Block','Allow')

179 −| summarize by Id,UserPrincipalName, AppDisplayName, Result

180 −| summarize Requests = count(), Users = dcount(UserPrincipalName), Block = countif(Result == "Block"), Allow = countif(Result == "Allow"), BlockedUsers = dcountif(UserPrincipalName, Result == "Block") by AppDisplayName

181 −| extend PctAllowed = round(100.0 * Allow/(Allow+Block), 2)

182 −| sort by Requests desc

183 −```

184 −

185 −The result of the previous query should be similar to the following screenshot:

186 −

187 −:::image type="content" source="media/concept-token-protection/log-analytics-results.png" alt-text="Screenshot showing example results of a Log Analytics query looking for token protection policies" lightbox="media/concept-token-protection/log-analytics-results.png":::

188 −

189 −The following query example looks at the non-interactive sign-in log for the last seven days, highlighting **Blocked** versus **Allowed** requests by **User**.

190 −

191 −```kusto

192 −//Per users query

193 −// Select the log you want to query (SigninLogs or AADNonInteractiveUserSignInLogs )

194 −//SigninLogs

195 −AADNonInteractiveUserSignInLogs

196 −// Adjust the time range below

197 −| where TimeGenerated > ago(7d)

198 −| project Id,ConditionalAccessPolicies, UserPrincipalName, AppDisplayName, ResourceDisplayName

199 −| where ConditionalAccessPolicies != "[]"

200 −| where ResourceDisplayName == "Office 365 Exchange Online" or ResourceDisplayName =="Office 365 SharePoint Online" or ResourceDisplayName =="Azure Virtual Desktop" or ResourceDisplayName =="Windows 365" or ResourceDisplayName =="Windows Cloud Login"

201 −//Add userPrincipalName if you want to filter

202 −// | where UserPrincipalName =="<user_principal_Name>"

203 −| mv-expand todynamic(ConditionalAccessPolicies)

204 −| where ConditionalAccessPolicies ["enforcedSessionControls"] contains '["Binding"]' or ConditionalAccessPolicies ["enforcedSessionControls"] contains '["SignInTokenProtection"]'

205 −| where ConditionalAccessPolicies.result !="reportOnlyNotApplied" and ConditionalAccessPolicies.result !="notApplied"

206 −| extend SessionNotSatisfyResult = ConditionalAccessPolicies.sessionControlsNotSatisfied

207 −| extend Result = case (SessionNotSatisfyResult contains 'SignInTokenProtection' or SessionNotSatisfyResult contains 'Binding', 'Block','Allow')

208 −| summarize by Id, UserPrincipalName, AppDisplayName, ResourceDisplayName,Result

209 −| summarize Requests = count(),Block = countif(Result == "Block"), Allow = countif(Result == "Allow") by UserPrincipalName, AppDisplayName,ResourceDisplayName

210 −| extend PctAllowed = round(100.0 * Allow/(Allow+Block), 2)

211 −| sort by UserPrincipalName asc

212 −```

213 −

214 −The following query example looks at the non-interactive sign-in log for the last seven days, highlighting users that are using devices, where Microsoft Entra ID device state doesn't satisfy Token protection CA policy requirements.

215 −

216 −```kusto

217 −AADNonInteractiveUserSignInLogs

218 −// Adjust the time range below

219 −| where TimeGenerated > ago(7d)

220 −| where TokenProtectionStatusDetails!= ""

221 −| extend parsedBindingDetails = parse_json(TokenProtectionStatusDetails)

222 −| extend bindingStatus = tostring(parsedBindingDetails["signInSessionStatus"])

223 −| extend bindingStatusCode = tostring(parsedBindingDetails["signInSessionStatusCode"])

224 −| where bindingStatusCode == 1003

225 −| summarize count() by UserPrincipalName

226 −```

227 −

228 −### End user experience

229 −

230 −A user that registered or enrolled their supported device doesn't experience any differences in the sign in experience on a token protection supported application when the token protection requirement is enabled.

231 −

232 −A user who hasn't registered or enrolled their device and if the token protection policy is enabled sees the following screenshot after authenticating.

71 +This process helps assess your users' client and app compatibility for token protection enforcement.

23372

23473 ### Deployment guides

23574

Conditional Access token protection

Microsoft's edit · 3 Mar 23:35 UTC