Policy: Azure > CIS v5.0 > 5 - Identity Services > 5.02 - Conditional Access > 5.02.08 - Ensure a Token Protection Conditional Access policy is considered > Attestation

From Azure Portal

To enable Token Protection Conditional Access Policy: 1. From Azure Home, navigate to Microsoft Entra ID > Security > Conditional Access 2. Create a new policy or modify an existing one 3. Under Assignments, select Users and Target resources as appropriate 4. Under Session controls, select Token protection (preview) 5. Set Require token protection for sign-in sessions to enabled 6. Configure Grant controls as appropriate 7. Set Enable policy to On 8. Click Create or Save

Note: Token protection is currently supported for desktop applications accessing Exchange Online and SharePoint Online on Windows devices.

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in report level Maximum Attestation Duration policy. Set to a blank value to clear the attestation.