Entra ID Device Code Sign-In to Finance/AP/Admin Accounts

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•1

Detects usage of the OAuth device code authentication flow by high-value accounts (Finance, Accounts Payable, Admins). This flow is often abused in phishing campaigns to obtain access tokens by coercing users to authorize malicious applications via a code entry process.