Entra Device Registration/PRT Issuance Following Device-Code Sign-In
Detects instances where the device code authentication protocol is utilized. This protocol is commonly used for headless devices, but is also frequently abused by adversaries for phishing and device code flow abuse to acquire unauthorized access tokens.
SentinelOne
