First-Time Device Code Authentication
Detects successful device code authentication flows from users who have not utilized this authentication method within the past 14 days. This rule monitors Entra ID (Azure AD) sign-in logs and non-interactive logs, enriching results with Intune device compliance data and authentication protocol details to assist in identifying anomalous access patterns that may indicate credential abuse or device-code phishing.
Microsoft Sentinel (KQL)
