Device Code Flow: Auth Broker to Microsoft Graph

Bryant Smith@flowstate

•updated Jun 5, 2026•5•0•21

Detects successful device code flow sign-ins to the Microsoft Authentication Broker application targeting the Microsoft Graph resource, specifically when the sign-in does not originate from a trusted named location. This activity can indicate a device code phishing attempt where an attacker tricks a user into authenticating a malicious application.