Conditional Access token protection
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit ac39502 · +5 −27 lines · also on GitHub
⋯ 21 unchanged lines
2222
> [!NOTE]
2323
> Use Token Protection as part of a broader defense-in-depth strategy against token theft. For more information, see [Protecting tokens in Microsoft Entra](../devices/protecting-tokens-microsoft-entra-id.md).
2424
25
−## Prerequisites
26
−
27
−[!INCLUDE [Microsoft Entra ID P1 license](~/includes/entra-p1-license.md)]
28
−
2925
## Requirements and availability
3026
3127
The following devices, platforms, and applications support accessing resources where a token protection Conditional Access policy is applied.
⋯ 36 unchanged lines
6864
6965
## Deployment
7066
71
−Select the guide for your target platform:
72
−
73
−- **Windows**: []()
74
−- **iOS, iPadOS, and macOS**: [Token Protection deployment guide - Apple](deployment-guide-token-protection-apple.md)
75
−
7667
For users, the deployment of a Conditional Access policy to enforce token protection should be invisible when using compatible client platforms on registered devices and compatible applications.
7768
7869
To minimize the likelihood of user disruption due to app or device incompatibility, follow these recommendations:
⋯ 4 unchanged lines
8374
- Analyze these logs long enough to cover normal application use.
8475
- Add known, reliable users to an enforcement policy.
8576
86
−This process helps assess your users’ client and app compatibility for token protection enforcement.
87
−
88
−### Supported applications
89
−
90
−- OneDrive sync client version 22.217 or newer
91
−- Teams native client version 1.6.00.1331 or newer
92
−- Power BI desktop version 2.117.841.0 (May 2023) or newer
93
−- [Exchange PowerShell module version 3.7.0 or newer](https://www.powershellgallery.com/packages/ExchangeOnlineManagement/3.7.0)
94
−- Microsoft Graph PowerShell version 2.0.0 or newer with [EnableLoginByWAM option](/powershell/module/microsoft.graph.authentication/set-mggraphoption#example-1-set-web-account-manager-support)
95
−- Visual Studio 2022 or newer when using the 'Windows authentication broker' Sign-in option
96
−- Windows App version 2.0.379.0 or newer
77
+This process helps assess your users' client and app compatibility for token protection enforcement.
9778
98
−The following resources support Token Protection:
79
+Select the guide for your target platform:
9980
100
−- Office 365 Exchange Online
101
−- Office 365 SharePoint Online
102
−- Microsoft Teams Services
103
−- Azure Virtual Desktop
104
−- Windows 365
81
+- **Windows**: [Token Protection deployment guide - Windows](deployment-guide-token-protection-windows.md)
82
+- **iOS, iPadOS, and macOS**: [Token Protection deployment guide - Apple](deployment-guide-token-protection-apple.md)
10583
10684
### Known limitations
107
−
85
+<!--- Should move to deployment guide - but make sure nothing is lost-->
10886
- Office perpetual clients aren't supported.
10987
- The following applications don't support signing in using protected token flows and users are blocked when accessing Exchange and SharePoint:
11088
- PowerShell modules accessing SharePoint
⋯ 27 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:13 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.