Untrusted named locations - Device Code Flow: Microsoft Office
Detects successful device code authentications specifically for the Microsoft Office application (AppId d3590ed6-52b3-4102-aeff-aad2292ab01c) that do not originate from trusted named locations. This can indicate a device code phishing attempt where an attacker has tricked a user into authenticating to a malicious application.
Microsoft Sentinel (KQL)
