Entra device registration/PRT issuance shortly after device code sign-in
Detects potential device code phishing activity by identifying users who successfully perform a device code authentication flow shortly before registering a new device in Azure AD. This pattern is indicative of an adversary tricking a user into authenticating a malicious device to the victim's account.
Microsoft Sentinel (KQL)
