Conditional Access token protection
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 925715e · +2 −2 lines · also on GitHub
⋯ 3 unchanged lines
44
ms.service: entra-id
55
ms.subservice: conditional-access
66
ms.topic: concept-article
7
−ms.date: 02/24/2026
7
+ms.date: 03/04/2026
88
ms.reviewer: sgrandhi
99
ms.custom:
1010
- sfi-image-nochange
⋯ 6 unchanged lines
1717
1818
Token Protection is a Conditional Access session control that attempts to reduce token replay attacks by ensuring only device bound sign-in session tokens, like [Primary Refresh Tokens (PRTs)](../devices/concept-primary-refresh-token.md), are accepted by Microsoft Entra ID when applications request access to protected resources.
1919
20
−When a user registers a supported device with Microsoft Entra, a PRT is issued and cryptographically bound to that device. This binding ensures that even if a threat actor steals a token, it can't be used from another device. With Token Protection enforced, Microsoft Entra validates that only these bound sign-in session tokens are used by supported applications.
20
+When a user registers a supported device with Microsoft Entra, a PRT is issued and cryptographically bound to that device. This binding ensures that even if a threat actor steals the token, it can't be used from another device. With Token Protection enforced, Microsoft Entra validates that only these bound sign-in session tokens are used by supported applications.
2121
2222
> [!NOTE]
2323
> Use Token Protection as part of a broader defense-in-depth strategy against token theft. For more information, see [Protecting tokens in Microsoft Entra](../devices/protecting-tokens-microsoft-entra-id.md).
⋯ 59 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:13 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.