Token protection policies are configured
Overview
Section titled “Overview”Without the Token Protection Conditional Access policy, threat actors who steal sign-in session tokens can replay them from any device to gain unauthorized access to resources. Token theft allows attackers to bypass authentication entirely because the stolen token is already a valid proof of identity. This access vector enables lateral movement, privilege escalation, and data exfiltration without triggering reauthentication challenges.
Token protection in Microsoft Entra ID binds sign-in session tokens to the device where they were originally issued, rendering stolen tokens unusable on attacker-controlled devices. Configuring the Conditional Access Token Protection policy for Windows and Apple platforms ensures that sign-in session tokens for critical services like SharePoint Online and Exchange Online can’t be replayed from unauthorized endpoints.
Remediation
Section titled “Remediation”Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Identity |
| Category | Access control |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| ATT&CK | T1550.004 Web Session Cookie, T1539 Steal Web Session Cookie |
| Licence | P1 |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.