A SharePoint site blocks access from unmanaged devices, and a Conditional Access policy for SharePoint Online uses app-enforced restrictions. A personal computer is blocked, while a domain-joined computer can access the site. We don't use Intune.
If someone steals a session token after a user signs in on an allowed device, would the site recognize that the token is being used from another device? Can stronger requirements be limited to this site?
Don't assume the site block makes a stolen session unusable. If an attacker gets a usable session cookie or token after the legitimate device has passed the checks, it may be replayable elsewhere. Blocking a fresh sign-in from a personal computer doesn't test that scenario.
Token protection is worth investigating, but check the current support and requirements for the specific SharePoint session and client you're using. Don't assume it protects every cookie or token in the flow.
Device registration or hybrid join and Intune compliance aren't the same test. Your results show that this setup is distinguishing the devices in your normal access tests. They don't establish that a stolen session is bound to the original device.
Requiring a compliant device may strengthen access controls, but adding Intune by itself isn't proof that a stolen browser session can't be replayed. Check the exact Conditional Access requirements and token protection coverage before treating that as the fix.
For a site-specific requirement, look at Conditional Access authentication contexts with a sensitivity label applied to the site. The context can trigger a policy for access to the protected site rather than applying the same requirement across all SharePoint content.
Check the licensing, label configuration and client behavior before rollout. Also test the effect on connected services and mobile access rather than assuming they'll all behave the same way. This gives you a way to scope a policy, not a guarantee against session replay.
Location rules and monitoring can still reduce exposure, but they're not a reliable replay prevention control. An attacker using an allowed location or an IP that hasn't been flagged might get through. Have a response process for suspicious sign-ins that includes revoking sessions and securing the account.
Answers are reviewed before publication.
v206~wrmask_8:
That sounds useful for keeping the stricter policy focused on the site. I'll check how it affects mobile clients before applying it.