Validates certificate binding only when the token's cnf (confirmation) claim contains an x5t#S256 certificate thumbprint.
Always validates certificate binding, rejecting tokens without a cnf claim.
Never validates certificate binding, even when the token carries a cnf claim.
Controls how certificate binding is validated for certificate-bound access tokens.