T1528: Non-Interactive Device-Code Protocol Sign-In Bypassing MFA (tenant_id=common)

Tim Peck@timpeck

•updated Jul 8, 2026•6•0•28

Detects Microsoft Entra ID sign-in events using the non-interactive OAuth device-code protocol against the 'common' tenant endpoint where MFA was not applied. This behavior is consistent with OAuth device-code phishing campaigns (e.g., Storm-2372/DEBULL) that exploit Conditional Access device-code flow allowances to bypass standard authentication controls.