Conditional Access token protection
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 8d1e158 · +12 −8 lines · also on GitHub
⋯ 3 unchanged lines
44
ms.service: entra-id
55
ms.subservice: conditional-access
66
ms.topic: concept-article
7
−ms.date: 03/24/2026
7
+ms.date: 08/10/2026
88
ms.reviewer: sgrandhi
99
ms.custom:
1010
- sfi-image-nochange
⋯ 15 unchanged lines
2626
2727
## Platform availability
2828
29
−| Platform | Status |
30
−|----------|--------|
31
−| Windows | Generally Available |
32
−| iOS / iPadOS | Preview |
33
−| macOS | Preview |
29
+| Platform | Native applications | Browser-based applications |
30
+|----------|---------------------|----------------------------|
31
+| Windows | Generally Available | Preview for supported web apps that access Azure Resource Manager |
32
+| iOS / iPadOS | Preview | Not supported |
33
+| macOS | Preview | Preview for supported web apps that access Azure Resource Manager |
3434
3535
> [!NOTE]
36
−> Token Protection currently supports native applications only. Browser-based applications are not supported.
36
+> Browser-based application support is currently limited to selected web apps, browsers, and device configurations that access Azure Resource Manager. For requirements and the list of supported applications, see [Token Protection deployment guide - Web apps](deployment-guide-token-protection-web-apps.md).
3737
3838
## Supported resources
3939
40
−Token Protection policy can be enforced on the following cloud resources:
40
+For native applications, Token Protection policy can be enforced on the following cloud resources:
4141
- Exchange Online
4242
- SharePoint Online
4343
- Microsoft Teams
⋯ 2 unchanged lines
4646
- Azure Virtual Desktop
4747
- Windows 365
4848
49
+For browser-based applications in preview, enforcement is supported for Azure Resource Manager, configured in Conditional Access as the **Windows Azure Service Management API** resource. Only selected web applications that access Azure Resource Manager are supported. For details, see [Token Protection deployment guide - Web apps](deployment-guide-token-protection-web-apps.md).
50
+
4951
:::image type="content" source="media/concept-token-protection/complete-policy-components-session.png" alt-text="Screenshot of a Conditional Access policy that requires token protection as the session control.":::
5052
5153
### Supported devices
⋯ 2 unchanged lines
5456
- Windows 10 or newer devices that are Microsoft Entra joined, Microsoft Entra hybrid joined, or Microsoft Entra registered. See the known limitations section in the appropriate deployment guide for unsupported device types.
5557
- Windows Server 2019 or newer that are hybrid Microsoft Entra joined.
5658
- For detailed steps on how to register your device, see [Register your personal device on your work or school network](https://support.microsoft.com/account-billing/register-your-personal-device-on-your-work-or-school-network-8803dd61-a613-45e3-ae6c-bd1ab25bf8a8).
59
+- Browser-based application support (Preview) has additional operating system, browser, extension, and configuration requirements. See [Token Protection deployment guide - Web apps](deployment-guide-token-protection-web-apps.md).
5760
5861
**Apple (Preview)**:
5962
- macOS 14.0 or later. Requires the Microsoft Enterprise single sign-on (SSO) plug-in. Alternatively, you can also use Platform SSO. Only MDM-managed devices are supported.
6063
- iOS / iPadOS 16.0 or later. Requires the Microsoft Enterprise SSO plug-in. Only MDM-managed devices are supported.
6164
- For detailed steps on how to set up, see [Enabling Microsoft Enterprise SSO plug-in](../../identity-platform/apple-sso-plugin.md) and configuring [Platform SSO for macOS](/intune/intune-service/configuration/platform-sso-macos).
65
+- Browser-based application support (Preview) on macOS has additional browser, extension, and configuration requirements. See [Token Protection deployment guide - Web apps](deployment-guide-token-protection-web-apps.md).
6266
6367
## Deployment
6468
⋯ 21 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:13 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.