Control: Azure > CIS v5.0 > 5 - Identity Services > 5.02 - Conditional Access > 5.02.08 - Ensure a Token Protection Conditional Access policy is considered

Configures auditing against a CIS Benchmark item.

Level: 2

This recommendation ensures that issued tokens are only issued to the intended device.

When properly configured, conditional access can aid in preventing attacks involving token theft, via hijacking or reply, as part of the attack flow. Although currently considered a rare event, the impact from token impersonation can be severe.

Resource Types

This control targets the following resource types:

Azure > Active Directory > Directory

Policies

This control type relies on these other policies when running actions:

In Your Workspace

Developers

Control Type URI

tmod:@turbot/azure-cisv5-0#/control/types/r050208

Category URI

tmod:@turbot/cis#/control/categories/v071204

GraphQL

query controlType(id: "tmod:@turbot/azure-cisv5-0#/control/types/r050208") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/azure-cisv5-0#/control/types/r050208'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/azure-cisv5-0#/control/types/r050208"