☁️
CTHFM: Azure
  • Welcome
  • Getting Started
    • Account Setup
      • Account Creation Instructions
  • Azure Fundamentals
    • Azure Fundamentals Overview
      • Azure Documentation
      • Azure Entra
      • Azure Hierarchy
      • Identities
      • Azure Entra Roles
      • Azure RBAC
      • Azure Licensing Overview
        • Azure Entra ID Premium Licenses Comparison
      • Azure Shared Responsibility Model
      • Azure Frameworks
      • Azure Security Services
      • Conditional Access Policies
        • How Conditional Access Policies Work
        • Benefits of Conditional Access
        • Best Practices for Conditional Access
        • Conditions for Conditional Access
        • Conditional Access Controls
        • Sign-In Risk and Identity Protection
        • Conditional Access Session Control
        • Name Locations IP Location
      • Azure Quotas
      • Azure Tokens
        • Access Tokens
        • ID Tokens
        • Refresh Tokens
          • Invalidate Refresh Tokens
        • Primary Refresh Tokens
        • Continuous Access Evaluation (CAE)
        • Token Protection: Conditional Access (Public Preview)
  • Azure CLI
    • Introduction to Azure CLI
    • Installing Azure CLI
    • CLI Commands
    • Resource Group Management
    • Creating and Managing Resources with Azure CLI
    • Managing IAM
    • Azure CLI Automation
    • Monitoring and Troubleshooting in Azure CLI
    • Azure CLI Overview
      • Azure CLI: Linux
      • Azure CLI: Windows
      • Azure CLI: MacOS
  • KQL
    • KQL Overview
      • KQL Introduction
      • Data Types
      • Quick Reference
      • Render
      • Basic Queries
  • Powershell
    • PowerShell for Azure
      • Powershell Documentation
      • Powershell Basics
      • Understanding Powershell Variables
      • Understanding Cmdlets
      • Powershell Console & ISE
      • Powershell: Entra Module
        • Module Reference & Getting Started
      • Powershell: Azure Module
        • Installation Instructions
        • Powershell Azure CLI: Windows
        • Powershell Azure CLI: Linux
        • Powershell Azure CLI: MacOS
        • Example Azure Cmdlets
  • Bicep
    • Bicep File Structure
    • Variable Types
  • Azure Logging References
    • Logging
      • Log Retention Strategies
      • Azure Log Types
      • Azure Activity Logs
        • Administrative Event Schema
        • Service Health Notification Schema
        • Resource Health
        • Alert Category
        • Autoscale
        • Security
        • Recommendation
        • Policy
      • Entra ID Logging
        • Identity Based Logs
          • Audit Logs
          • Sign-In Logs
            • AADNonInteractiveUserSignInLogs
            • AADManagedIdentitySignInLogs
            • AADServicePrincipalSignInLogs
            • First Party Sign-In Activity
          • Provisioning Logs (AADProvisioningLogs)
          • Microsoft Graph Activity
          • Identity Protection
            • Risk Detections
            • AADRiskyServicePrincipals
            • AADRiskyUsers
            • AADUserRiskEvents
            • AADServicePrincipalRiskEvents
        • Additional Entra ID Logs
      • Azure Key Vault
        • Azure Key Vault Logging Overview
      • Network Watcher
        • RBAC Permissions
        • Flow Log Types
          • NSG Flow Log Schema
          • VNET Flow Log Schema
        • Enabling Logs
          • NSG Flow Logs
          • VNET Flow Logs
        • Packet Capture
          • Packet Capture: VM
          • Packet Capture: Scale Sets
      • Compute Resources
        • Azure Monitor Agent
        • VM Insights
          • VM Insights Tables
      • Storage Accounts
        • Storage Account Logging
          • File
            • Enable StorageFileLogs
            • StorageFileLogs
          • Blob
            • Enable Blob Logging
            • StorageBlobLogs
          • Queue
            • Enable Queue Logging
            • StorageQueueLogs Table
          • Table
            • Enable Table Logging
            • StorageTableLogs Table
      • Azure App Service
        • Log Types
        • Enabling Logging
      • Azure Monitor
        • Resource Logs
          • Resource Log Top Level Documentation
        • Log Analytics Workspace
          • Setup
        • Workbooks
        • Dashboards
        • Alerts
        • Azure Monitor Documentation
      • Defender for Cloud
      • Intune
      • Sysmon
      • Purview Audit Log Schema
      • Kubernetes Audit Log (AKS)
  • Threat Hunting
    • Threat Hunting in Azure
      • Threat Hunting Introduction
      • Threat Hunting Process
        • Hypothesis Generation
        • Investigation
        • Identification
        • Resolution & Follow Up
      • Pyramid of Pain
      • Azure Threat Hunting Ideas
      • Hands On Threat Hunting Examples
      • OSINT Feeds
  • Sigma
    • Sigma Rule Structure
  • Microsoft Defender TI
    • Microsoft Defender Threat Intelligence
      • Data Sets
      • Reputational Scoring
      • Analyst Insights
      • Microsoft Defender TI: Copilot Integration
  • MITRE Att&ck
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Data Sources
      • MITRE Att&ck Mitigations
      • MITRE Att&ck: Azure
        • MITRE Att&CK: Azure Security Control Mapping
  • Microsoft Resources
    • Microsoft Incident Response Ninja Hub
    • Microsoft Defender XDR Ninja Hub
  • Azure Threat Research Matrix (ATRM)
  • Security Research & Resources
    • Azure Goat
    • Azure Security Research
      • Azure Related CVEs
  • Defender XDR
    • Defender XDR Overview
    • Defender XDR Licensing
    • Defender XDR Default Retention
    • Defender XDR Advanced Hunting Table Schemas
    • Automated Response Requirements
    • Supported Response Actions
  • Azure Sentinel
    • Sentinel Overview
    • Azure Sentinel Deployments
    • Supported Data
    • Workbook, Playbook, Notebook Comparison
    • Sentinel Workbooks
    • Entities
    • User and Entity Behavior Analytics
    • Anomaly Detection
    • Mult-Stage Attack Detection
    • Sentinel: Az CLI
  • Microsoft Defender
    • Microsoft Defender for Cloud References
    • Defender for Cloud: Az CLI
  • Azure Policy
    • Azure Policy
    • Azure Policy Components
    • Azure Policy Rules
    • Scope Azure Policy
    • Policy Assignments
    • Policy Effect
    • Initiative Definition
    • Policy Parameters
    • Remediation Task Structure
    • Use Cases for Azure Policy
    • Azure Policy: Az CLI
  • Intune
    • Intune Overview
    • Intune Licensing
    • Intune API Permission Scopes
    • Intune Sample Script Resources
  • Intune Logging
    • Configure Logging
    • Logging Schema References
    • Intune Queries and Resources
  • Windows Host Security
    • Windows System Architecture and OS Fundamentals
    • SysInternals
    • Basic vs Advanced Security Auditing
    • Sysmon
  • Adversary Emulation
    • AzureHound
    • AADInternals
      • Install
    • RoadTools
      • Install
    • Oh365UserFinder
    • GraphRunner
  • Incident Response
    • Incident Response
      • Azure IR Program Development Cheat Sheet
      • Azure IR Playbooks (MS Guidance)
      • Ransomware (MS Guidance)
  • Automation
    • Automation Overview
    • Logic Apps
      • How Logic Apps Work
      • Logic App Types
      • Triggers
      • Connectors
      • Conditional Logic and Control Flow
      • APIs in Logic Apps
      • Handling Large Workflows with Stateful Logic Apps
      • External Service Integration
      • Securing, Managing, and Scaling Azure Logic Apps
      • Logic Apps: Az CLI
  • Packet Analysis
    • Wireshark Cheatsheet
    • TShark Cheatsheet
    • TCPDUMP Cheatsheet
    • Protocol Analysis Basics
    • HTTP Response Code Cheatsheet
    • RFC Protocol Mappings
    • PCAP Acquisition
  • Detection Lab
    • Detection Lab Introduction
    • Account Creation Instructions
    • Enable MFA Within Azure Tenant
    • Create an Azure Admin With Cloud Shell
    • Setup and Install Instructions
  • VSCode and Code Setup
  • Deploying Code
  • Enabling Logs for Log Analytics Workspace
  • Logging Into Windows VM
  • Verifying Logs in Log Analytics Workspace
  • Creating Detections: Azure Monitor
  • Cost Management: Billing Alarms
Powered by GitBook
On this page
  • Primary Refresh Token (PRT) Overview
  • Key Concepts and Components of a PRT
  • What Does a PRT Contain?
  • How is a PRT Issued?
  • PRT Lifetime and Renewal
  • How is a PRT Used?
  • PRT Protection Mechanisms
  • Multi-Factor Authentication (MFA) and PRT
  • PRT Invalidation Scenarios
  • PRT Usage During App Token Requests
  • PRT and Browser SSO
  • PRT and Security Considerations
  • PRT Renewal and MFA Claims
  1. Azure Fundamentals
  2. Azure Fundamentals Overview
  3. Azure Tokens

Primary Refresh Tokens

Primary Refresh Token (PRT) Overview

A Primary Refresh Token (PRT) is an essential authentication artifact used in the Microsoft Entra ID to enable Single Sign-On (SSO) across applications and services on a user's device. It is a JSON Web Token (JWT) that serves as a foundational component to streamline user authentication, reduce repeated login prompts, and provide secure access to multiple applications without requiring users to reauthenticate frequently.

PRTs are designed for Windows 10 and later, Windows Server 2016 and later, as well as iOS and Android devices. These tokens are fundamental for creating a seamless and secure experience for users accessing different apps and services using the same device.

Key Concepts and Components of a PRT

PRTs function in conjunction with several key components in the Microsoft Entra ID ecosystem, especially on Windows devices:

  • Cloud Authentication Provider (CloudAP): This component handles the authentication for Windows logins, verifying user credentials during sign-in. It facilitates the issuance of a PRT by working with Microsoft Entra ID.

  • Web Account Manager (WAM): Acts as a token broker on Windows, helping obtain tokens for apps and enabling SSO. It provides a standardized way for apps to interact with identity providers.

  • Trusted Platform Module (TPM): A hardware component that provides additional security for user and device secrets. It secures cryptographic keys, which are used to protect PRTs from being stolen or tampered with.

  • Microsoft Entra CloudAP Plugin and WAM Plugin: These plugins interface with CloudAP and WAM to ensure SSO experiences for Microsoft Entra authenticated devices. They verify credentials, issue PRTs, and facilitate token renewals and requests for apps.

What Does a PRT Contain?

A PRT includes:

  • Device ID: This identifies the specific device to which the PRT is tied. It helps Microsoft Entra ID determine the state of the device, such as whether it complies with organizational policies.

  • Session Key: A symmetric key used as proof of possession, ensuring that any token request made using a PRT comes from the original device. This key is encrypted and bound to the device to prevent unauthorized use.

The PRT is a secure and opaque token, meaning that its contents are not accessible to client components and are only readable by Microsoft Entra ID.

How is a PRT Issued?

A PRT is issued during device registration and user authentication under specific conditions:

  • Device Registration: Devices must be registered with Microsoft Entra ID to obtain a PRT. During registration, the dsreg component generates cryptographic key pairs (Device Key and Transport Key), which are bound to the device's TPM.

  • PRT Issuance:

    • Microsoft Entra Joined or Hybrid Joined Devices: A PRT is issued during Windows login when users sign in with their organization credentials, such as passwords or Windows Hello for Business.

    • Microsoft Entra Registered Devices: A PRT can be issued when a user adds a secondary work account to their Windows device. The issuance happens through settings or prompts from apps like Outlook.

In these scenarios, the Microsoft Entra CloudAP plugin is responsible for communicating with Microsoft Entra ID to authenticate the user and issue a PRT.

PRT Lifetime and Renewal

  • Lifetime:

    • A PRT is typically valid for 14 days.

    • The validity is continually extended as long as the user keeps using the device, which prevents frequent reauthentication.

  • Renewal:

    • CloudAP Plugin Renewal: The PRT is renewed every 4 hours by the CloudAP plugin as part of regular Windows sign-in activity.

    • WAM Plugin Renewal: The WAM plugin can also renew the PRT while processing token requests for applications. If a refresh token is unavailable, WAM uses the PRT to obtain a new access token and refresh token, which also renews the PRT.

How is a PRT Used?

A PRT enables Single Sign-On (SSO) across all applications on the user's device, facilitating seamless authentication without repeated prompts:

  • Microsoft Entra CloudAP Plugin: During user sign-in to Windows, the CloudAP plugin uses the PRT to authenticate the user and cache the PRT for subsequent sign-ins, even in offline scenarios.

  • Microsoft Entra WAM Plugin: When a user accesses applications or web resources, the WAM plugin uses the PRT to request necessary access or refresh tokens, enabling SSO. For web applications, the WAM plugin injects the PRT into the browser, enabling automatic authentication.

PRT Protection Mechanisms

The security of a PRT is primarily handled by binding it to the device:

  • TPM Binding: During device registration, cryptographic keys are generated, and the private keys are stored securely in the TPM. The TPM acts as a hardware vault, ensuring that the keys used to secure the PRT cannot be extracted or tampered with.

  • Proof of Possession (Session Key): When a PRT is issued, Microsoft Entra ID provides an encrypted session key, which acts as proof of possession. This key is encrypted with the Transport Key and can only be decrypted by the TPM. This mechanism ensures that any token requests made using a PRT are signed by the correct session key and cannot be used from any other device.

Multi-Factor Authentication (MFA) and PRT

  • When users sign in using Windows Hello for Business, the PRT issued contains an MFA claim. This means that applications relying on the PRT do not need additional MFA prompts, providing a smoother user experience.

  • MFA can also be triggered during token requests through WAM if additional verification is required, and the renewed PRT will carry this MFA claim.

PRT Invalidation Scenarios

A PRT can be invalidated for several reasons:

  • User or Device Disabled: If the user or device is disabled in Microsoft Entra ID, the corresponding PRT is invalidated.

  • Password Change: If a user changes their password, the PRT obtained using the old password is invalidated. Upon the next login, a new PRT is issued.

  • TPM Issues: If the TPM fails, the PRT cannot be renewed. The device must go through a re-registration process to generate new cryptographic keys and obtain a new PRT.

PRT Usage During App Token Requests

  • When an application, like Outlook, requires an access token, the WAM plugin uses the PRT to request the token.

  • The WAM plugin signs these requests with the session key, ensuring that Microsoft Entra ID can validate the origin and integrity of the request.

  • If successful, Microsoft Entra ID issues an access token and a refresh token, encrypted with the session key, which are securely managed by the WAM plugin.

PRT and Browser SSO

  • Browser Single Sign-On: When a user opens a browser and navigates to a Microsoft Entra login page, the PRT is used to authenticate the user seamlessly.

  • The CloudAP plugin creates a PRT cookie signed with the session key, which is sent back to the browser for authentication purposes. This approach binds the cookie to the device and prevents unauthorized replay attacks.

PRT and Security Considerations

  • PRT is a sensitive artifact and must be protected rigorously. It is critical to bind the PRT to the TPM to ensure that it cannot be extracted from the device or reused elsewhere.

  • Microsoft Entra Conditional Access policies are not evaluated when issuing or renewing a PRT, so security at the device level must be ensured.

  • TPM 2.0 is recommended for all Microsoft Entra devices to enhance the security of PRTs. TPM 1.2 is not used for PRT protection due to reliability concerns.

PRT Renewal and MFA Claims

  • MFA During Sign-In: If users log in with Windows Hello for Business or if MFA is required during WAM token requests, the renewed PRT will contain an MFA claim, extending the MFA validity without prompting users multiple times.

  • Partitioned PRTs: Windows maintains separate PRTs for different credential types (e.g., password, Windows Hello, smart card). Each PRT contains specific claims related to the credential used, keeping MFA claims isolated.

Last updated 6 months ago