Device Code Flow: Microsoft Office from Untrusted Location

Bryant Smith@flowstate

•updated Jun 5, 2026•1•0•21

Detects successful sign-ins to Microsoft Office applications using the device code flow (FOCI AppId d3590ed6-52b3-4102-aeff-aad2292ab01c) that originate from an untrusted network location. This activity can indicate a device code phishing attack where an adversary has tricked a user into authenticating a malicious application.