Require token protection for sign-in sessions" is blocking Power BI

Simon Brown 0 Reputation points
2026-08-21T12:58:12.1933333+00:00

We have just setup Require token protection for sign-in sessions but it is now blocking Power BI session control not satisfied, I have excluded the user for now but I need a fix for this issue. device is Azure joined and complant and has all the current channels applied

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-08-21T12:58:28.33+00:00

    Power BI is being blocked because token protection support is limited and browser-based applications are not supported in the Windows token protection guidance. Power BI Desktop is listed as a supported application, but browser-based apps are not.

    For a fix, check how Power BI is being accessed:

    1. If access is through a browser
      • This is expected to fail with token protection in the Windows deployment guidance because browser-based applications are not supported.
      • If the Conditional Access policy includes Browser, remove that selection for the Windows token protection policy.
      • In the Windows policy configuration, under Client apps, only select Mobile apps and desktop clients.
      • Leaving Browser selected can block web apps.
    2. If access is through Power BI Desktop
      • Power BI Desktop is supported, so verify the client is current.
      • Older Power BI Desktop versions can have sign-in issues. Update to the latest version, restart Power BI Desktop, and sign in again.
      • If sign-in still fails, in Power BI Desktop go to:
        • File > Options and settings > Options > Security
        • Enable Use updated sign-in experience for data sources
      • If Use my default web browser is enabled on an older version, clear it, restart Power BI Desktop, and sign in again.
    3. Review the Conditional Access policy mode
      • Set the token protection policy to Report-only first.
      • Then review Sign-in logs in Microsoft Entra admin center:
        • Entra ID > Monitoring & health > Sign-in logs
        • Add the Token Protection – Sign-in session status code column
        • Review the Conditional Access or Report-only tab for the blocked sign-in
        • Check Session controls to confirm whether token protection requirements were satisfied
        • Check Basic info > Token Protection - Sign-in Session
    4. If this policy is intended for web scenarios such as ARM only
      • The web-app preview guidance is specific and requires Browser only for that scenario.
      • That guidance does not establish general browser support for Power BI. Do not use the web-app preview settings as a general template for Power BI.

    In short: for Windows token protection, use a separate Conditional Access policy that targets only supported client types and supported apps. For Power BI, token protection is supported for Power BI Desktop, not general browser access.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.