Token Protection
Token Protection is a Microsoft Entra Conditional Access session control that requires supported sign-in session tokens to be cryptographically bound to a device when supported applications request protected resources.
Binding a sign-in token to a device
Token Protection requires supported sign-in session tokens, such as a Primary Refresh Token, to be bound to the device. Copying the token to another machine should not be enough to use it for the protected access.
This is a specific Entra control. It does not make every access token or application cookie device-bound. Support depends on the platform, application, resource, and configuration. Microsoft’s current documentation lists native-app support and limited browser-app support separately.
Check the application’s path before rollout
Confirm that the client and resource are supported, then examine the relevant interactive and non-interactive sign-ins during a pilot. A report-only policy helps observe impact but does not enforce the requirement.
Device binding also answers a different question from device compliance. Binding ties the token to a device; compliance assesses that device against configured requirements. If access requires both, verify both controls.
This control addresses replay from another device. It is not a general defense against someone already operating inside a compromised endpoint.