# User sign-in activity uses token protection
A threat actor can intercept or extract authentication tokens from memory, local storage on a legitimate device, or by inspecting network traffic.
Source: https://maester.dev/docs/tests/ZTA.21786
:::note[Maester checks this too]
[CIS.M365.5.2.2.16](/docs/tests/CIS.M365.5.2.2.16) (Ensure Token Protection is enforced for session tokens) checks the same setting. Running both reports it twice.
:::
## Overview
A threat actor can intercept or extract authentication tokens from memory, local storage on a legitimate device, or by inspecting network traffic. The attacker might replay those tokens to bypass authentication controls on users and devices, get unauthorized access to sensitive data, or run further attacks. Because these tokens are valid and time bound, traditional anomaly detection often fails to flag the activity, which might allow sustained access until the token expires or is revoked.
Token protection, also called token binding, helps prevent token theft by making sure a token is usable only from the intended device. Token protection uses cryptography so that without the client device key, no one can use the token.
## Remediation
- [Deploy a Conditional Access policy to require token protection](https://learn.microsoft.com/entra/identity/conditional-access/concept-token-protection?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Identity |
| Category | Access control |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Conditional Access |
| Area | Authentication |
| ATT&CK | [T1550.001](/docs/tests?mitre=T1550.001) Application Access Token, [T1550.004](/docs/tests?mitre=T1550.004) Web Session Cookie |
| Licence | P1 |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.