Entra Device Code OAuth Grant Token Capture (ARToken)

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•2

Detects successful authentication events using the OAuth 2.0 Device Code flow, which is frequently leveraged by adversaries to perform phishing attacks and bypass traditional interactive login requirements.