Azure AD Phantom Device Registration via Device Code Flow to DRS

Ibrahim Saud@tektrix

•updated Jun 24, 2026•2•0•6

Detects anomalous device registration in Azure AD where a device code flow is used to authenticate to the Device Registration Service (DRS) and the resulting device is registered with an 'Unknown' or 'Linux' operating system. This behavior is indicative of an adversary, such as Storm-2372, using tools like AADInternals to perform phantom device registration to bypass conditional access policies by simulating a device without TPM attestation.