Conditional Access token protection
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit d9356a6 · +1 −34 lines · also on GitHub
⋯ 21 unchanged lines
2222
> [!NOTE]
2323
> Use Token Protection as part of a broader defense-in-depth strategy against token theft. For more information, see [Protecting tokens in Microsoft Entra](../devices/protecting-tokens-microsoft-entra-id.md).
2424
25
−## Requirements and availability
26
−
27
−The following devices, platforms, and applications support accessing resources where a token protection Conditional Access policy is applied.
28
−
29
−### Platform availability
25
+## Platform availability
3026
3127
| Platform | Status |
3228
|----------|--------|
⋯ 47 unchanged lines
8076
8177
- **Windows**: [Token Protection deployment guide - Windows](deployment-guide-token-protection-windows.md)
8278
- **iOS, iPadOS, and macOS**: [Token Protection deployment guide - Apple](deployment-guide-token-protection-apple.md)
83
−
84
−### Known limitations
85
−<!--- Should move to deployment guide - but make sure nothing is lost-->
86
−- Office perpetual clients aren't supported.
87
−- The following applications don't support signing in using protected token flows and users are blocked when accessing Exchange and SharePoint:
88
− - PowerShell modules accessing SharePoint
89
− - PowerQuery extension for Excel
90
− - Extensions to Visual Studio Code which access Exchange or SharePoint
91
−- The following Windows client devices aren't supported:
92
− - Surface Hub
93
− - Windows-based Microsoft Teams Rooms (MTR) systems
94
−- [External users](/entra/external-id/what-is-b2b) who meet the token protection device registration requirements in their home tenant are supported. However, users who don't meet these requirements see an unclear error message with no indication of the root cause.
95
−- Devices registered with Microsoft Entra ID using the following methods are unsupported:
96
− - Microsoft Entra joined [Azure Virtual Desktop session hosts](/azure/virtual-desktop/azure-ad-joined-session-hosts).
97
− - Windows devices deployed using [bulk enrollment](/mem/intune-service/enrollment/windows-bulk-enroll).
98
− - [Cloud PCs deployed by Windows 365](/windows-365/enterprise/identity-authentication#device-join-types) that are Microsoft Entra joined.
99
− - Power Automate hosted machine groups that are [Microsoft Entra joined](/power-automate/desktop-flows/hosted-machine-groups#general-network-requirements).
100
− - Windows Autopilot devices deployed using [self-deploying mode](/autopilot/self-deploying).
101
− - Windows virtual machines deployed in Azure using the virtual machine (VM) extension that are enabled for [Microsoft Entra ID authentication](/entra/identity/devices/howto-vm-sign-in-azure-ad-windows).
102
−
103
−To identify the impacted devices due to unsupported registration types listed previously, inspect the `tokenProtectionStatusDetails` attribute in the sign-in logs. Token requests that are blocked due to an unsupported device registration type, can be identified with a `signInSessionStatusCode` value of 1003.
104
−
105
−To prevent disruption during onboarding, modify the token protection Conditional Access policy by adding a device filter condition that excludes devices in the previously described deployment category. For example, to exclude:
106
−
107
−- Cloud PCs that are Microsoft Entra joined, you can use `systemLabels -eq "CloudPC" and trustType -eq "AzureAD"`.
108
−- Azure Virtual Desktops that are Microsoft Entra joined, you can use `systemLabels -eq "AzureVirtualDesktop" and trustType -eq "AzureAD"`.
109
−- Power Automate hosted machine groups that are Microsoft Entra joined, you can use `systemLabels -eq "MicrosoftPowerAutomate" and trustType -eq "AzureAD"`.
110
−- Windows Autopilot devices deployed using self-deploying mode, you can use enrollmentProfileName property. As an example, if you have created an enrollment profile in Intune for your Autopilot self-deployment mode devices as "Autopilot self-deployment profile", you can use `enrollmentProfileName -eq "Autopilot self-deployment profile".
111
−- Windows virtual machines in Azure that are Microsoft Entra joined, you can use `profileType -eq "SecureVM" and trustType -eq "AzureAD"`.
11279
11380
## Related content
11481
⋯ 1 unchanged line
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:13 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.