Microsoft is extending Token Protection beyond native applications to supported browser-based experiences, adding another layer of protection against token theft and replay attacks.
With Token Protection, Microsoft Entra Conditional Access can require device-bound sign-in session tokens, such as Primary Refresh Tokens (PRTs). Because these tokens are cryptographically tied to the registered device, a stolen token can't simply be replayed from another device.
🌐 The Web Apps Preview currently supports:
🔹 Azure portal
🔹 Microsoft Intune admin center
🔹 Microsoft Entra admin center
🔹 Microsoft Engage Center
🔹 Microsoft Engage Hub
The protected resource is Azure Resource Manager (ARM), configured in Conditional Access as the Windows Azure Service Management API.
🛡️ Why this matters
Session and token theft have become increasingly important identity attack vectors. Even when MFA is enabled, a stolen session token can potentially allow an attacker to bypass another authentication challenge.
Token Protection helps address this by introducing device binding:
User Authentication → Device-Bound Token → Conditional Access Validation → Protected Resource
If the required token isn't properly bound to the device, access can be blocked.
⚠️ Since web app support is still Preview, Microsoft recommends starting with a pilot group, deploying the Conditional Access policy in Report-only mode, and reviewing sign-in logs before enforcement.
💡 Bottom line: MFA protects the authentication process; Token Protection adds another defense by helping ensure the resulting sign-in session stays tied to the trusted device.
Another important step toward stronger Zero Trust and identity-first security.
