Device code auth requested via python-requests spoofing Auth Broker app

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•3

This rule detects non-interactive Azure AD sign-in attempts that utilize the device code authentication flow, specifically targeting a Microsoft authentication broker App ID while originating from a Python-requests user agent. This combination is often indicative of automated scripts or malicious tools attempting to bypass standard authentication workflows to gain access to cloud resources.