Device Code Auth Flow Abuse with Cross-IP Token Replay

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•1

Detects successful authentication events in Microsoft Entra ID (formerly Azure AD) that utilize the 'device code' OAuth flow. This flow is often used by command-line utilities and headless applications to authenticate users on devices without a web browser, but it is also frequently abused by attackers to perform phishing and session hijacking.