Token Protection Conditional access policy is blocking access to PowerShell Modules.

Question

Hi Everyone,&nbsp;&nbsp;Recently we have started implementing Microsoft token protection via CAP.&nbsp;&nbsp;We have created the policy based on the Microsoft documentation: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection&nbsp;Everything is working fine for regular users,&nbsp; but for our admin accounts that require access to Powershell modules,&nbsp; they get this error when trying to access:&nbsp;I've confirmed this is linked to the token protection policy and no other policy is causing this behavior.&nbsp;&nbsp;The policy is configured in the following way:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;My question here is: How can I keep our admin accounts included on this policy without affecting Powershell access?&nbsp;&nbsp;Thank you for your help.

michael_suchacek · Answer

Token protection only supports Exchange PowerShell module version 3.7.0 or newer and Microsoft Graph PowerShell version 2.0.0 or newer with EnableLoginByWAM option

Are your admins using these and are being blocked?

How Token Protection Enhances Conditional Access Policies - Microsoft Entra ID | Microsoft Learn

Forum Discussion

Token Protection Conditional access policy is blocking access to PowerShell Modules.

1 Reply

Resources