Conditional Access token protection

This page's changes and edits · All guidance changes

Microsoft's edit · 3 Mar 20:54 UTC

Fix KQL bugs in Token Protection article

Microsoft's commit message in MicrosoftDocs/entra-docs · commit c527bab · +5 −7 lines · also on GitHub

⋯ 3 unchanged lines

44 ms.service: entra-id

55 ms.subservice: conditional-access

66 ms.topic: concept-article

7 −ms.date: 08/20/2025

7 +ms.date: 03/03/2026

88 ms.reviewer: sgrandhi

99 ms.custom:

1010 - sfi-image-nochange

⋯ 189 unchanged lines

200200 | project Id,ConditionalAccessPolicies, Status,UserPrincipalName, AppDisplayName, ResourceDisplayName

201201 | where ConditionalAccessPolicies != "[]"

202202 | where ResourceDisplayName == "Office 365 Exchange Online" or ResourceDisplayName =="Office 365 SharePoint Online" or ResourceDisplayName =="Azure Virtual Desktop" or ResourceDisplayName =="Windows 365" or ResourceDisplayName =="Windows Cloud Login"

203 −| where ResourceDisplayName == "Office 365 Exchange Online" or ResourceDisplayName =="Office 365 SharePoint Online"

204203 //Add userPrincipalName if you want to filter

205204 // | where UserPrincipalName =="<user_principal_Name>"

206205 | mv-expand todynamic(ConditionalAccessPolicies)

207206 | where ConditionalAccessPolicies ["enforcedSessionControls"] contains '["Binding"]' or ConditionalAccessPolicies ["enforcedSessionControls"] contains '["SignInTokenProtection"]'

208207 | where ConditionalAccessPolicies.result !="reportOnlyNotApplied" and ConditionalAccessPolicies.result !="notApplied"

209208 | extend SessionNotSatisfyResult = ConditionalAccessPolicies["sessionControlsNotSatisfied"]

210 −| extend Result = case (SessionNotSatisfyResult contains 'SignInTokenProtection' or SessionNotSatisfyResult contains 'SignInTokenProtection', 'Block','Allow')

211 −| summarize by Id,UserPrincipalName, AppDisplayName, Result

209 +| extend Result = case (SessionNotSatisfyResult contains 'SignInTokenProtection' or SessionNotSatisfyResult contains 'Binding', 'Block','Allow')

210 +| summarize by Id,UserPrincipalName, AppDisplayName, Result

212211 | summarize Requests = count(), Users = dcount(UserPrincipalName), Block = countif(Result == "Block"), Allow = countif(Result == "Allow"), BlockedUsers = dcountif(UserPrincipalName, Result == "Block") by AppDisplayName

213212 | extend PctAllowed = round(100.0 * Allow/(Allow+Block), 2)

214213 | sort by Requests desc

⋯ 15 unchanged lines

230229 | project Id,ConditionalAccessPolicies, UserPrincipalName, AppDisplayName, ResourceDisplayName

231230 | where ConditionalAccessPolicies != "[]"

232231 | where ResourceDisplayName == "Office 365 Exchange Online" or ResourceDisplayName =="Office 365 SharePoint Online" or ResourceDisplayName =="Azure Virtual Desktop" or ResourceDisplayName =="Windows 365" or ResourceDisplayName =="Windows Cloud Login"

233 −| where ResourceDisplayName == "Office 365 Exchange Online" or ResourceDisplayName =="Office 365 SharePoint Online"

234232 //Add userPrincipalName if you want to filter

235233 // | where UserPrincipalName =="<user_principal_Name>"

236234 | mv-expand todynamic(ConditionalAccessPolicies)

237235 | where ConditionalAccessPolicies ["enforcedSessionControls"] contains '["Binding"]' or ConditionalAccessPolicies ["enforcedSessionControls"] contains '["SignInTokenProtection"]'

238236 | where ConditionalAccessPolicies.result !="reportOnlyNotApplied" and ConditionalAccessPolicies.result !="notApplied"

239237 | extend SessionNotSatisfyResult = ConditionalAccessPolicies.sessionControlsNotSatisfied

240 −| extend Result = case (SessionNotSatisfyResult contains 'SignInTokenProtection' or SessionNotSatisfyResult contains 'SignInTokenProtection', 'Block','Allow')

241 −| summarize by Id, UserPrincipalName, AppDisplayName, ResourceDisplayName,Result

238 +| extend Result = case (SessionNotSatisfyResult contains 'SignInTokenProtection' or SessionNotSatisfyResult contains 'Binding', 'Block','Allow')

239 +| summarize by Id, UserPrincipalName, AppDisplayName, ResourceDisplayName,Result

242240 | summarize Requests = count(),Block = countif(Result == "Block"), Allow = countif(Result == "Allow") by UserPrincipalName, AppDisplayName,ResourceDisplayName

243241 | extend PctAllowed = round(100.0 * Allow/(Allow+Block), 2)

244242 | sort by UserPrincipalName asc

⋯ 31 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:13 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.