An organization is implementing token protection in Microsoft Entra ID Conditional Access for users accessing Azure AI Foundry. Token protection binds the token to the device. Which scenario is prevented by enabling token protection?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because token protection (token binding) cryptographically binds an access token to the specific device on which it was issued. If an attacker steals the token via AiTM proxy or malware, they cannot use the token from a different device because the Azure AI Foundry resource will reject it—the token signature does not match the new device's proof-of-possession key.
Full explanation below image
Full Explanation
B is correct because token protection (token binding) cryptographically binds an access token to the specific device on which it was issued. If an attacker steals the token via AiTM proxy or malware, they cannot use the token from a different device because the Azure AI Foundry resource will reject it—the token signature does not match the new device's proof-of-possession key. A is wrong because token protection does not prevent sign-ins from unregistered devices; device compliance is enforced through 'require compliant device' or 'require hybrid Entra joined device' grant controls. C is wrong because token protection secures issued tokens; it does not prevent credential compromise or MFA bypass—those are addressed by phishing-resistant MFA and risk-based policies. D is wrong because network-based access restrictions are enforced through Named Locations in Conditional Access, not through token protection.