Detect Successful Device Code Authentication Shortly After URL Click

P den Dulk@Patrickdd

•updated Mar 18, 2026•97•1•645

This analytic query detects potential phishing compromise activity by correlating URL click events from Defender for Office 365 with Sign-in device code authentication logs.