CIS - Enforce token protection for session tokens

Policy conditions

Users

All users

Apps

00000003-0000-0ff1-ce00-000000000000, cc15fd57-2c6c-4117-a88c-83b1d56b4bbe, 00000002-0000-0ff1-ce00-000000000000, 9cdead84-a844-4324-93f2-b2e6bb768d07, 0af06dc6-e4b5-4f28-818e-e78e62d137a5

Platforms

windows

{
  "templateId": null,
  "displayName": "CIS - Enforce token protection for session tokens",
  "modifiedDateTime": null,
  "state": "enabledForReportingButNotEnforced",
  "deletedDateTime": null,
  "grantControls": null,
  "partialEnablementStrategy": null,
  "conditions": {
    "userRiskLevels": [],
    "signInRiskLevels": [],
    "clientAppTypes": [
      "mobileAppsAndDesktopClients"
    ],
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "includeApplications": [
        "00000003-0000-0ff1-ce00-000000000000",
        "cc15fd57-2c6c-4117-a88c-83b1d56b4bbe",
        "00000002-0000-0ff1-ce00-000000000000",
        "9cdead84-a844-4324-93f2-b2e6bb768d07",
        "0af06dc6-e4b5-4f28-818e-e78e62d137a5"
      ],
      "excludeApplications": [],
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "includeUsers": [
        "All"
      ],
      "excludeUsers": [],
      "includeGroups": [],
      "excludeGroups": [],
      "includeRoles": [],
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    },
    "platforms": {
      "includePlatforms": [
        "windows"
      ],
      "excludePlatforms": []
    }
  },
  "sessionControls": {
    "disableResilienceDefaults": null,
    "applicationEnforcedRestrictions": null,
    "cloudAppSecurity": null,
    "signInFrequency": null,
    "persistentBrowser": null,
    "continuousAccessEvaluation": null,
    "blockSensitiveActions": null,
    "secureSignInSession": {
      "isEnabled": true
    }
  },
  "Tag": "CIS",
  "summary": "The CIS - Enforce token protection for session tokens policy applies session token binding to key Microsoft services including SharePoint Online, Exchange Online, and Microsoft Teams. Token protection ties session tokens to the device on which they were issued, meaning a stolen token cannot be replayed from a different device. This defends against token theft attacks, which have become more prevalent as attackers increasingly look to bypass MFA by intercepting session tokens rather than credentials."
}