Device-code OAuth flow abuse against M365 via Authentication Broker

Ibrahim Saud@tektrix

•updated Aug 3, 2026•4•0•19

Detects device-code OAuth authentication flow abuse against Microsoft 365 accounts, identified by sign-ins to Microsoft Authentication Broker with originalTransferMethod=deviceCodeFlow, correlated for repeated attempts on the same account within a short window