CIS.M365.5.2.2.16 - (L2) Ensure Token Protection is enforced for session tokens
Overview
An enabled Conditional Access policy requires token protection for Exchange Online, SharePoint Online and Microsoft Teams on Windows desktop clients.
Session tokens are bearer tokens: whoever holds one can use it. Token protection binds a sign-in token to the device it was issued to, so a token copied by malware or a proxy does not work from another machine.
The capability is limited to supported Windows clients and to Exchange Online, SharePoint Online and Teams, and incompatible apps are blocked. The benchmark requires a user scope other than None. Check the sign-in logs in report-only mode to see which users and apps would be affected before enforcing.
User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Conditional Access > Policies and select New policy.
- Under Users, include a non-empty user scope; the benchmark requires this field to be other than None.
- Under Target resources, select Select resources and add Office 365 Exchange Online, Office 365 SharePoint Online and Microsoft Teams Services.
- Under Conditions > Device platforms, include Windows. Under Client apps, select Mobile apps and desktop clients only.
- Under Session, select Require token protection for sign-in sessions.
- Set Enable policy to On (use Report-only first to measure the impact) and select Create.
Related links
- Microsoft Entra admin center - Conditional Access policies
- Conditional Access: token protection
- Configure token protection
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.16
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.2.16 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1550.004 Web Session Cookie |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.16 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:5.2.2.16, nist-800-53-r5:SC-23 |
| PowerShell test | Test-MtCisTokenProtection |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.2.16.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.2.16.md