Detections
Analytics

5.2.2.16 Ensure Token Protection is enforced for session tokens

Information

Token Protection is a Conditional Access session control that attempts to reduce token replay attacks by ensuring only device bound sign-in session tokens, like Primary Refresh Tokens (PRTs), are accepted by Microsoft Entra ID when applications request access to protected resources.

When a user registers a supported device with Microsoft Entra, a PRT is issued and cryptographically bound to that device. This binding ensures that even if a threat actor steals the token, it can't be used from another device. With Token Protection enforced, Microsoft Entra validates that only these bound sign-in session tokens are used by supported applications.

The recommended state is to enforce Token Protection for Office 365 Exchange Online, Office 365 SharePoint Online and Microsoft Teams Services.

When properly configured, Conditional Access can aid in preventing attacks involving token theft, via hijacking or replay, as part of the attack flow. Although currently considered a rare event, the impact from token impersonation can be severe.

Solution

To remediate using the UI:

 - Navigate to the Microsoft Entra admin center https://entra.microsoft.com.
 - Expand Entra ID > Conditional Access and select Policies.
 - Select New policy.
 - Select Users or agents (Preview) :

 - Under Include, select the users or groups to apply this policy.
 - Under Exclude exclude any break-glass accounts.

 - Select Target resources > Resources > Include > Select resources

 - Under Select specific resources, select the following applications:

 - Office 365 Exchange Online
 - Office 365 SharePoint Online
 - Microsoft Teams Services

 - Choose Select

 - Select Conditions :

 - Under Device platforms

 - Set Configure to Yes.
 - Include > Select device platforms > Windows.
 - Select Done.

 - Under Client apps :

 - Set Configure to Yes
 - Under Modern authentication clients, only select Mobile apps and desktop clients.
 - Select Done

 - Under Access controls > Session, select Require token protection for sign-in sessions (Generally available for Windows. Preview for MacOS, iOS) and click Select.
 - Under Enable policy set it to Report-only.
 - Click Create.
 - After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On.

Impact:

Token Protection currently supports native applications only. Browser-based applications are not supported. There are also many other known limitations documented in the link below:

https://learn.microsoft.com/en-us/entra/identity/conditional-access/deployment-guide-token-protection-windows#known-limitations

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-11

Plugin: microsoft_azure

Control ID: 29fe1b4c6d6509a609783b12954a7d5cedb3e4e5d4e512c1c9eb09284fc3fd82