Device code phishing: understanding the attack and blocking the flow safely

How the legitimate flow works

A device that cannot display a sign-in page (a meeting room system, a command-line tool, a connected appliance) requests a code from Entra ID. The user enters that code on a Microsoft page from another device, signs in, and the original device receives the access and refresh tokens.

How it is abused

1. The attacker starts the flow themselves and obtains a code valid for a few minutes.
2. They send it to the victim under a plausible pretext: a meeting invitation, a shared document, a message from "support".
3. The victim goes to the genuine Microsoft page, enters the code and signs in normally, MFA included.
4. The tokens are issued to the attacker's session, which can then reach mail, files and Teams.

Because the page is genuine, phishing-resistant methods do not stop the attack: the victim is the one authorising the sign-in.

Identify legitimate uses first

Before blocking anything, measure who uses the flow. In the sign-in logs, filter on the "Device code" authentication protocol. With Log Analytics or Microsoft Sentinel:

SigninLogs
| where TimeGenerated > ago(30d)
| where AuthenticationProtocol == "deviceCode"
| summarize SignIns = count() by UserPrincipalName, AppDisplayName, IPAddress
| sort by SignIns desc

Check the column names against your workspace schema. Typical uses: meeting room devices, a few administrators running command-line tools, some specialised terminals.

Blocking with the authentication flows condition

Conditional Access offers an "authentication flows" condition covering the device code flow and authentication transfer. A sensible approach:

• a policy targeting all users and all resources, with the "device code flow" condition and a "block" control;
• a narrow exclusion for the legitimate uses identified, for instance a group of room accounts combined with a network location;
• a few weeks in report-only mode, then enforcement.

Authentication transfer, which moves a session from a computer to a mobile device via a QR code, deserves the same treatment if it is not in use.

What an audit checks

• Whether a policy blocks the device code flow, and its state (enabled or report-only).
• The scope and justification of exclusions.
• How authentication transfer is handled.
• Whether detection is in place for device code sign-ins outside the authorised scope.