What this check looks at
Checks for a Conditional Access policy requiring token protection on Windows desktop apps for Exchange Online, SharePoint Online and Teams, as CIS asks.
When someone signs in on a Windows device registered with Entra ID, the device is given a sign-in session token (a Primary Refresh Token) that is bound to it cryptographically. Apps such as Outlook, OneDrive and Teams use it to get their own tokens without asking again. Unless something checks, Entra ID also accepts session tokens that are not bound to a device, so a token stolen from a machine can be replayed from anywhere.
Token protection is a Conditional Access session control that makes Entra ID accept only device-bound sign-in sessions for the apps the policy names. The check looks for an enabled policy, as CIS describes it, that targets users, includes at least Office 365 Exchange Online, Office 365 SharePoint Online and Microsoft Teams Services, applies to Windows and to mobile apps and desktop clients only, and requires token protection. A policy in report-only mode is a warning. Graph returns the token protection setting only in its beta version; when that read fails for a policy that could be the one, the check reports not checked.
Token protection works for native apps only, not browsers, and has known limitations for some apps and device types, so it is usually rolled out to a group at a time after report-only testing.
Why it matters
Malware that steals a signed-in session from a device lets an attacker replay it elsewhere without the password or MFA. Token protection makes Entra ID accept desktop app sessions only from the device they were issued to.
Infostealer malware copies session tokens off a device and sells them, and the attacker replays the session from their own machine with no password or MFA prompt; the sign-in looks like the user’s. With token protection, a session token bound to the user’s device is refused when it is presented from any other device, for the protected apps. It does not cover browser sessions, so cookies stolen by adversary-in-the-middle phishing kits need other controls, such as phishing-resistant MFA.
CIS rates token theft as rare but severe. Mailbox and file access from a replayed session is where invoice fraud and data theft start, and it is invisible to MFA.
CIS Microsoft 365 Foundations Benchmark v7.0.0 5.2.2.16 (Level 2) asks for token protection for Exchange Online, SharePoint Online and Teams. CIS maps it to no CIS Controls v8 safeguard. NIST CSF 2.0 PR.AA-03 and NCSC CAF B2.a cover authenticating users commensurate with risk.
How to fix it
Where: Entra admin centre → Entra ID → Conditional Access
Before you start
- Needs Microsoft Entra ID P1 and Windows devices registered with Entra ID. Read Microsoft’s known limitations, and start in report-only mode with a pilot group.
Step by step
- Check devices and licences. Token protection needs Microsoft Entra ID P1 and, for Windows, devices joined, hybrid joined or registered with Entra ID. In the Entra admin centre under Entra ID > Devices, check which of the people you will protect use such devices, and read Microsoft’s known limitations for token protection before choosing them.
- Create the policy in report-only mode. Go to Entra ID > Conditional Access > Policies > New policy. Under Users, include a pilot group and exclude break-glass accounts. Under Target resources, select Office 365 Exchange Online, Office 365 SharePoint Online and Microsoft Teams Services. Under Conditions, set Device platforms to Windows and Client apps to Mobile apps and desktop clients only. Under Session, select Require token protection for sign-in sessions. Set Enable policy to Report-only.
- Review the sign-in log. After a week or two, filter the sign-in log by the policy and look for sign-ins it would have blocked. Unsupported apps, unregistered devices and older Office versions show up here; fix or exclude them before enforcing.
- Switch it on and widen it. Set Enable policy to On for the pilot group, then add more groups as the report-only results allow. CIS asks for at least one enabled policy; protecting everyone who uses supported devices is the aim.
- Confirm the policy. Open the policy and check the target resources, Windows platform, client apps and session control. The next assessment passes once the policy is on.
What users will notice
On Windows, Outlook, OneDrive, Teams and other desktop apps keep working on registered devices; sign-ins from unregistered devices or unsupported apps to Exchange, SharePoint and Teams are blocked.
How to confirm it worked
Entra admin centre → Entra ID → Conditional Access shows an enabled policy for Exchange Online, SharePoint Online and Teams Services on Windows, mobile apps and desktop clients, with Require token protection for sign-in sessions.
Frameworks and controls
This check maps to controls in 11 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| NIS2 | Art. 21(2)(j) Multi-factor authentication and secured communications |
| Microsoft Cloud Security Benchmark | IM-7 Restrict resource access based on conditions |
| Zero Trust | IdentitiesDevices |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.5.2 Authenticate users, processes and devices |
| CMMC Level 2 | IA.L2-3.5.2 Authentication |
| ISO 27001:2022 | A.8.5 Secure authentication |
| CIS M365 | 5.2.2.16 Ensure Token Protection is enforced for session tokens |
| NIST CSF 2.0 | PR.AA-03: Users, services, and hardware are authenticated |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Token protection in Microsoft Entra Conditional Access (Microsoft Learn)