High-volume device code authentication in Entra sign-in logs

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•4

Detects anomalous activity associated with the OAuth 2.0 device code grant flow in Azure AD. By aggregating authentication requests within 15-minute windows, the rule identifies potential device code phishing or abuse, specifically flagging users exhibiting high-frequency polling (5 or more requests) or attempts from multiple distinct source IP addresses for a single session.