ARToken PRT Issuance After Device-Code Sign-In (Entra Persistence)

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•2

Detects a suspicious sequence of events where a user performs a device-code authentication followed by a device registration or PRT issuance within a 30-minute window. This behavior is indicative of an adversary using an OAuth device code flow to phish an initial access token, subsequently using it to register an adversary-controlled device for persistent access or to bypass Conditional Access policies.