| name | cis-azure-foundations-5.2.8 |
| description | Ensure a Token Protection Conditional Access policy is considered |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","identity","conditional-access"] |
| cis_id | 5.2.8 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-5.2.7","cis-azure-foundations-5.2.4"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure a Token Protection Conditional Access policy is considered
Description
This recommendation ensures that issued tokens are only issued to the intended device.
Rationale
When properly configured, conditional access can aid in preventing attacks involving token theft, via hijacking or reply, as part of the attack flow. Although currently considered a rare event, the impact from token impersonation can be severe.
Impact
A Microsoft Entra ID P1 or P2 license is required.
Start with a Conditional Access policy in "Report Only" mode prior to enforcing for all users.
Audit Procedure
Using Azure Portal
- Sign in to the Microsoft Entra admin center as at least a
Conditional Access Administrator.
- Browse to
Protection > Conditional Access > Policies.
- Review existing policies to ensure that at least one policy contains the following configuration:
- Under
Assignments, review Users or workload identities and
- Under
Include, ensure the scope of the users or groups is appropriate for your organization.
- Under
Exclude, ensure only necessary users and groups (your organization's emergency access or break-glass accounts) are excepted.
- Under
Target resources > Resources > Include > Select resources: Ensure that both Office 365 Exchange Online and Office 365 SharePoint Online are selected.
- Under
Conditions > Device Platforms: Ensure Configure is set to Yes and Include indicates Windows platforms.
- Under
Conditions > Client Apps: Ensure Configure is set to Yes and Mobile Apps and Desktop Clients is selected under Modern Authentication Clients.
- Under
Access controls > Session, ensure that Require token protection for sign-in sessions is selected.
Expected Result
At least one Conditional Access policy should exist with Token Protection configured, targeting Office 365 Exchange Online and SharePoint Online on Windows platforms with mobile apps and desktop clients.
