Forum Discussion

markjanbakker's avatar
markjanbakker
Tin Contributor
Jul 01, 2026
Solved

Device Bound Session Credentials Edge

Hi everyone, For a customer i did some research about token protection within M365. I did find a lot information what to configure within M365 to get a multi layer protection (CA, Identity Protectio...
Identity
microsoft 365
security
  • Kidd_Ip's avatar
    Kidd_Ip
    Jul 01, 2026

    It does not currently support Device Bound Session Credentials (DBSC) in browser sessions. While Microsoft Edge (from version 145 onward, with Edge 147 stabilizing the feature) implements DBSC as a web platform capability, M365 services like Outlook, Teams, and SharePoint Online have not announced adoption of DBSC for cookie/session binding. The supported path for token protection in M365 remains Entra ID device-bound tokens via the Web Account Manager (WAM) and Conditional Access policies, learn.microsoft.com/en-us/entra/msal/javascript/browser/device-bound-tokens

markjanbakker's avatar
markjanbakker
Tin Contributor
Jul 02, 2026

Thanks for the clear answer. 

So am i right to say that when a user clicks on a phising link in Outlook (which opens in a browser) from a managed device and gives credentials and MFA, the token is unprotected and can be use for replay?