Azure AD Device Code Authentication Phishing

This analytic identifies Azure Device Code Phishing attacks by detecting suspicious authentication requests using the device code authentication protocol within Azure AD SignInLogs. Such activity is significant as it indicates potential bypassing of Multi-Factor Authentication (MFA) and Conditional Access Policies (CAPs) through phishing. If malicious, attackers could gain unauthorized access to Azure AD, Exchange mailboxes, and Outlook Web Application (OWA), leading to potential data breaches and unauthorized data access.