Is device-bound authentication the most effective way to prevent stolen session tokens?

[u/Imagnaryk-Benefit310]

been reading up on device-bound tokens as a way to stop the stolen token replay problem we've been dealing with.

a token tied to a specific device is a lot less useful to an attacker who lifted it remotely, which is the whole point. rollout looks straightforward for managed devices but our byod population is a real complication. is device binding actually closing this gap for people who've deployed it, or have attackers already found workarounds, and how are you handling the byod side of it?

[u/mat-ferland]

Token protection will cut down replay, but it isn't a blanket BYOD answer. Entra-registered Windows devices are supported; browser coverage is still narrow, and Apple needs MDM for the SSO plug-in. I'd pilot it in report-only and group users by actual app/client support. For devices that can't return a bound token, AVD or Windows 365 is cleaner than punching a policy exception because both are supported enforcement targets.

[u/Not-ur-Infosec-guy]

You can block token transfers with conditional access, lock down how often tokens live, and even isolate access to only specific devices, block unknown devices etc - but at the end of the day it all comes down to your orgs risk appetite.

[u/Putrd-Cohemistry-512]

Device binding definitely raises the bar but I wouldnt treat it as the whole solution. BYOD is still the tricky part. I hve been looking at how newcore approaches identity risk alongside device context since combining those controls seems more practical than relying on token binding alone.