Entra ID Device Code Authentication Flow (ARToken Phishing)

Ibrahim Saud@tektrix

•updated Sep 19, 2026•3•0•7

Detects sign-in events in Entra ID where the OAuth 2.0 device authorization grant (device code) flow is utilized. This flow is a common vector for phishing attacks designed to steal tokens by tricking users into authenticating on a secondary device, potentially bypassing MFA.