# (L2) Ensure Token Protection is enforced for session tokens

An enabled Conditional Access policy requires token protection for Exchange Online, SharePoint Online and Microsoft Teams on Windows desktop clients.

Source: https://maester.dev/docs/tests/CIS.M365.5.2.2.16

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.2.2.16
```

## Overview

An enabled Conditional Access policy requires token protection for Exchange Online, SharePoint Online and Microsoft Teams on Windows desktop clients.

Session tokens are bearer tokens: whoever holds one can use it. Token protection binds a sign-in token to the device it was issued to, so a token copied by malware or a proxy does not work from another machine.

The capability is limited to supported Windows clients and to Exchange Online, SharePoint Online and Teams, and incompatible apps are blocked. The benchmark requires a user scope other than **None**. Check the sign-in logs in report-only mode to see which users and apps would be affected before enforcing.

User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to **Entra ID** > **Conditional Access** > [**Policies**](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) and select **New policy**.
3. Under **Users**, include a non-empty user scope; the benchmark requires this field to be other than **None**.
4. Under **Target resources**, select **Select resources** and add **Office 365 Exchange Online**, **Office 365 SharePoint Online** and **Microsoft Teams Services**.
5. Under **Conditions** > **Device platforms**, include **Windows**. Under **Client apps**, select **Mobile apps and desktop clients** only.
6. Under **Session**, select **Require token protection for sign-in sessions**.
7. Set **Enable policy** to **On** (use **Report-only** first to measure the impact) and select **Create**.

#### Related links

* [Microsoft Entra admin center - Conditional Access policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)
* [Conditional Access: token protection](https://learn.microsoft.com/entra/identity/conditional-access/concept-token-protection)
* [Configure token protection](https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-session)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.16](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.2.2.16 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1550.004 Web Session Cookie |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.16 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:5.2.2.16, nist-800-53-r5:SC-23 |
| PowerShell test | [Test-MtCisTokenProtection](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.16.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.2.2.16.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.16.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.2.2.16.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.16.md)