MFA Security Issues

Fix Samsung Mail MFA Sign-In Token Protection Unbound Error in Microsoft 365

Maira Mehtab Sep 22, 2026 868 views

Question details

The user is unable to sign in to Microsoft 365 using the Samsung Mail app due to an MFA verification failure linked to token protection policies.

Product: Microsoft 365 / Samsung Mail
Device & OS: Android
Scenario: Attempting to access Microsoft 365 emails via the native Samsung Mail application.
Observed behavior: Sign-in fails after MFA verification, and the admin center sign-in log displays 'Token Protection, Sign-In Session: Unbound, statusCode 1002'.

Before you start

Ensure you have access to the Microsoft Entra admin center or can contact your IT administrator, as resolving token protection issues requires checking organization-level Conditional Access policies.

Solution 1Recommended

Review Conditional Access Policies and Test with Outlook

Verify if the organization's Conditional Access policies strictly require bound tokens, which the native Samsung Mail app may not fully support.

Token Protection in Microsoft Entra ID ensures that the token used to access resources is cryptographically bound to the device. Many native mobile mail applications do not support this advanced binding.

Using a fully compliant application is the fastest way to resolve this access block.

Access Microsoft Entra Logs

Log in to the Microsoft Entra admin center as an administrator and navigate to the Sign-in logs to review the specific Conditional Access policy blocking the Samsung Mail app.

Check Authentication Requirements

Look for policies enforcing 'Token Protection' or requiring a compliant device/MAM policy that the native mail app cannot satisfy.

Test with Microsoft Outlook

Download and install the official Microsoft Outlook app for Android from the Google Play Store, sign in with your Microsoft 365 credentials, and complete MFA to see if the bound token requirement is satisfied.

App Support Limitation: Native mail applications often do not support advanced Microsoft Entra Token Protection features. Using the official Outlook app is highly recommended for security compliance.

Solution 2

Escalate to the Microsoft 365 Administrator

If you are an end-user, you will need administrative assistance to bypass or resolve organizational policy restrictions.

Free Microsoft Office alternative

Need a Reliable Alternative for Mobile Office Work? Try WPS Office

While dealing with strict Microsoft 365 device policies and access blocks, you might need a lightweight, hassle-free app to handle your documents on the go. WPS Office is a free, highly compatible alternative that lets you edit Word, Excel, and PowerPoint files smoothly without complex enterprise token protection barriers.

1. Download the App: Visit the Google Play Store or Apple App Store and search for WPS Office to install the application.
2. Open Your Documents: Launch WPS Office and open your existing Office files directly from local storage or standard cloud drives.
3. Edit and Share: Use the comprehensive mobile tools to edit documents, spreadsheets, and presentations instantly.

Free to use with a lightweight mobile footprintFully compatible with Microsoft Office formats (.docx, .xlsx, .pptx)Familiar and intuitive user interface for seamless migrationDoes not require complex Entra ID token binding for local document editing

microsoft office alternative - wps office

Frequently Asked Questions

What does 'Token Protection Unbound' mean in Microsoft 365?

This error occurs when a Conditional Access policy enforces token protection, meaning the authentication token must be cryptographically bound to the device hardware. The native Samsung Mail app often cannot fulfill this cryptographic requirement, resulting in an 'unbound' session.

How can I bypass the statusCode 1002 error on Android?

As an end-user, you cannot bypass this security policy directly. You must either switch to an explicitly supported application like Microsoft Outlook for Android or ask your IT administrator to adjust the Conditional Access policy for your account.

Why does MFA succeed but the sign-in still fails?

Multi-Factor Authentication (MFA) only verifies your identity. Even if MFA succeeds, the subsequent sign-in will fail if the application or device does not meet the organization's broader device compliance or token protection policies.

Can I configure Samsung Mail to support Token Protection?

Currently, native email apps like Samsung Mail lack the deep integration with Microsoft Authenticator and Microsoft Intune Company Portal required to generate securely bound tokens. Using the official Microsoft Outlook app is the recommended solution.

Microsoft Office Security Issues