Entra ID Sign-In via Device Code Authentication Flow

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•2

Detects interactive sign-ins to Microsoft Entra ID using the OAuth 2.0 device authorization grant flow. Attackers commonly abuse this flow in 'device code phishing' campaigns to capture access and refresh tokens, effectively bypassing MFA requirements.