ConsentFix OAuth Device Code Flow Abuse — Sensitive Resource Access

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•8

Detects successful OAuth device code authentication flows targeted at sensitive Microsoft cloud resources (Exchange Online, SharePoint, Teams, Graph) originating from unmanaged or non-compliant devices. This pattern is often indicative of consent phishing or device code phishing attacks where an adversary obtains a device token to gain long-term unauthorized access to user data.