Take a look at the article I linked. It says: "Microsoft Entra Internet Access for Microsoft services capabilities are included in a Microsoft Entra ID P1 or Microsoft Entra ID P2 license."

@fabian.bader.cloud, @naunheim.cloud and I have also looked into the topic of TokenSmith and are describing the Blue Team perspective (including an effective detection) in this blog:
www.glueckkanja.com/blog/securit...

A Compliant Network behaves like a Named Location and triggers the Continuous Access Evaluation trigger.
This will force the user to reauthenticate if the token is CAE enabled (and the Service is SharePoint Online).
-> learn.microsoft.com/en-us/entra/...
-> learn.microsoft.com/en-us/entra/...

4/4

Why should you do this?

You get the option to protect your resources behind the compliant network control by configuring a Conditional Access policy
-> learn.microsoft.com/en-us/entra/...

This policy is regarding to my tests really powerful to protect against replayed tokens.

3/4

Means: you can install the Global Secure Access Client on all your clients and route the traffic to all the Microsoft Endpoints through GSA.
-> learn.microsoft.com/en-us/entra/...

The client is available for Windows, Mac, Android and iOS and it is really easy to deploy.

2/4

gist.github.com/CloudProtect...

This one does a very good job because it considers if the device is joined/registered any only looks at the AADGraph. For this resource its not normal that a non-registered device is accessing it

Any tips? That's a really strange coincidence - ours needs to be replaced too...