Require token protection for desktop access to Exchange Online, SharePoint Online and Teams

Description

A Conditional Access policy applies the session control Require token protection for sign-in sessions to native (desktop) applications that access Office 365 Exchange Online, Office 365 SharePoint Online and Microsoft Teams Services, on Windows devices. With this control, only sign-in sessions cryptographically bound to the device (through the Primary Refresh Token) are accepted: a token copied to another machine is refused.

The policy is scoped with the Device platforms condition (Windows, and macOS or iOS when the Enterprise SSO plug-in is deployed) and the Client apps condition set to Mobile apps and desktop clients only.

Browser support is limited (preview, Azure Resource Manager only). Because the policy only covers some platforms, combine it with a policy that blocks unknown or unsupported device platforms (CB-M365-AUTH-021) so an attacker cannot simply present another platform.

Rationale

Infostealer malware and adversary-in-the-middle kits steal refresh tokens and session cookies, then replay them from attacker infrastructure. MFA does not help once the token is issued. Token protection binds the session to a key held by the device, so the stolen token is useless elsewhere.

Impact

Only supported clients on Microsoft Entra joined, hybrid joined or registered Windows 10+ devices (and MDM-managed Apple devices with the SSO plug-in) can access the targeted resources. Older Office builds, third-party clients and unregistered devices are blocked. Do not target the Office 365 app group, and do not include Browser in the client apps condition, or Teams on the web and other MSAL.js apps break. Roll out to pilot groups first.

Applies when

Requires: Microsoft Entra ID P1

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
2. Browse to Entra ID > Conditional Access > Policies.
3. Find a policy with State set to On where:
   • Users includes all users, or groups covering all users of supported devices;
   • Target resources includes Office 365 Exchange Online, Office 365 SharePoint Online and Microsoft Teams Services;
   • Conditions > Device platforms includes Windows;
   • Conditions > Client apps selects only Mobile apps and desktop clients;
   • Session > Require token protection for sign-in sessions is selected.
4. Browse to Entra ID > Monitoring & health > Sign-in logs, open a recent Outlook sign-in from Windows and check that the policy shows Success.
5. Alternative in PowerShell (Microsoft Graph, scope Policy.Read.All): export the policies with Get-MgIdentityConditionalAccessPolicy | ConvertTo-Json -Depth 10 and look for the token protection session control in sessionControls.
6. Fail if no enabled policy requires token protection, or if it covers only a pilot group.

Remediation

1. Check device readiness: Windows devices must be Microsoft Entra joined, hybrid joined or registered, with current Microsoft 365 Apps.
2. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
3. Browse to Entra ID > Conditional Access > Policies > New policy.
4. Users: a pilot group first; exclude the emergency access accounts.
5. Target resources > Select resources: Office 365 Exchange Online, Office 365 SharePoint Online, Microsoft Teams Services (and Azure Virtual Desktop, Windows 365, Windows Cloud Login if Windows App is used).
6. Conditions > Device platforms > Windows; Client apps > only Mobile apps and desktop clients.
7. Session > Require token protection for sign-in sessions.
8. Set Enable policy to Report-only; review interactive and non-interactive sign-ins for incompatible clients, then switch to On and widen the user scope step by step.

Rollback

Set the policy to Report-only or Off, or remove the affected users from its scope.

References

• Token protection in Microsoft Entra Conditional Access Microsoft, vendor-doc, accessed 2026-10-24
• Token protection deployment guide - Windows Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-M365-AUTH-021 Block unknown or unsupported device platforms
• related CB-M365-AUTH-024 Limit administrator sessions with sign-in frequency and non-persistent browsers

People and lifecycle