OAuth Device Code Phishing Redirect to Microsoft Device Login Page

Duo Tech@duotech

•updated Jul 21, 2026•8•0•27

This rule detects proxy requests directed to the legitimate Microsoft OAuth 2.0 device authorization endpoint (/common/oauth2/deviceauth). This activity is indicative of OAuth device code phishing, where a user is tricked into entering a malicious or attacker-provided device code into the legitimate Microsoft device login page to complete an authentication flow and grant unauthorized access to an attacker-controlled application.