A signed token is a cryptographically protected authentication artifact issued after a successful sign-in. The signature lets the identity provider verify that the token was created by a trusted authority and has not been altered, which makes the token usable for access to cloud apps, APIs, or other protected resources.
Signed tokens matter because they are the proof that a login completed correctly. In attacks, an adversary may steal credentials or manipulate a sign-in flow and still let the victim receive a valid token, making the session appear legitimate. Defenders therefore focus on token issuance, signing keys, and sign-in logs, not just passwords. Strong controls around authentication methods, tenant configuration, and token validation help reduce abuse.