# Conditional Access App Control session policies are enforced for sensitive cloud apps
A stolen session token can let a threat actor access a sensitive cloud app from an unmanaged device without triggering a new sign-in.
Source: https://maester.dev/docs/tests/ZTA.41080
## Overview
A stolen session token can let a threat actor access a sensitive cloud app from an unmanaged device without triggering a new sign-in. Conditional Access App Control routes the session through Microsoft Defender for Cloud Apps, where session policies can monitor activity, block downloads or copying, require step-up authentication, and apply sensitivity labels. This check confirms that at least one enabled Conditional Access policy routes targeted cloud apps through Defender for Cloud Apps session control.
## Remediation
- [Protect apps with Microsoft Defender for Cloud Apps Conditional Access App Control](https://learn.microsoft.com/en-us/defender-cloud-apps/proxy-intro-aad)
- [Deploy Conditional Access App Control for featured apps](https://learn.microsoft.com/en-us/defender-cloud-apps/proxy-deployment-aad)
- [Create access and session policies](https://learn.microsoft.com/en-us/defender-cloud-apps/session-policy-aad)
- [Conditional Access policy resource type](https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccesspolicy)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | SecOps |
| Category | Identity threat protection |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Conditional Access |
| Area | Access control |
| ATT&CK | [T1550.004](/docs/tests?mitre=T1550.004) Web Session Cookie, [T1530](/docs/tests?mitre=T1530) Data from Cloud Storage |
| Licence | ADALLOM_S_STANDALONE&AAD_PREMIUM |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.