Conditional Access token protection

This page's changes and edits · All guidance changes

Microsoft's edit · 26 Feb 22:42 UTC

PM-updates-TOC

Microsoft's commit message in MicrosoftDocs/entra-docs · commit f646b47 · +4 −4 lines · also on GitHub

⋯ 16 unchanged lines

1717

1818 Token Protection is a Conditional Access session control that attempts to reduce token replay attacks by ensuring only device bound sign-in session tokens, like [Primary Refresh Tokens (PRTs)](../devices/concept-primary-refresh-token.md), are accepted by Microsoft Entra ID when applications request access to protected resources.

1919

20 −When a user registers a Windows 10 or later device with Microsoft Entra, a PRT is issued and cryptographically bound to that device. This binding ensures that even if a threat actor steals a token, it can't be used from another device. With Token Protection enforced, Microsoft Entra validates that only these bound sign-in session tokens are used by supported applications.

20 +When a user registers a supported device with Microsoft Entra, a PRT is issued and cryptographically bound to that device. This binding ensures that even if a threat actor steals a token, it can't be used from another device. With Token Protection enforced, Microsoft Entra validates that only these bound sign-in session tokens are used by supported applications.

2121

2222 > [!NOTE]

2323 > Use Token Protection as part of a broader defense-in-depth strategy against token theft. For more information, see [Protecting tokens in Microsoft Entra](../devices/protecting-tokens-microsoft-entra-id.md).

⋯ 30 unchanged lines

5454 - For detailed steps on how to register your device, see [Register your personal device on your work or school network](https://support.microsoft.com/account-billing/register-your-personal-device-on-your-work-or-school-network-8803dd61-a613-45e3-ae6c-bd1ab25bf8a8).

5555

5656 **Apple (Preview)**:

57 −- macOS 11.0 or later. Requires the Microsoft Enterprise SSO plug-in. You can also use Platform SSO. Only MDM-managed devices are supported.

57 +- macOS 11.0 or later. Requires the Microsoft Enterprise SSO plug-in. Alternatively, you can also use Platform SSO. Only MDM-managed devices are supported.

5858 - iOS / iPadOS 14.0 or later. Requires the Microsoft Enterprise SSO plug-in. Only MDM-managed devices are supported.

5959 - For detailed steps on how to setup, see [Enabling Microsoft Enterprise SSO plug-in](../../identity-platform/apple-sso-plugin.md) and configuring [Platform SSO for macOS](/intune/intune-service/configuration/platform-sso-macos).

6060

6161 ## Deployment

6262

63 −For users, the deployment of a Conditional Access policy to enforce token protection should be invisible when using compatible client platforms on registered devices and compatible applications.

64 −

6563 To minimize the likelihood of user disruption due to app or device incompatibility, follow these recommendations:

6664

6765 - Start with a pilot group of users and expand over time.

⋯ 3 unchanged lines

7169 - Add known, reliable users to an enforcement policy.

7270

7371 This process helps assess your users' client and app compatibility for token protection enforcement.

72 +

73 +### Deployment guides

7474

7575 Select the guide for your target platform:

7676

⋯ 6 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:13 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.