Microsoft Entra ID Device Code Authentication Flow Sign-In
Detects sign-in events within Microsoft Entra ID (formerly Azure AD) that utilize the 'deviceCode' authentication protocol. This OAuth 2.0 flow is designed for devices with limited input (e.g., smart TVs, IoT devices, CLI tools) but is frequently abused by attackers in 'device code phishing' campaigns to obtain access tokens by tricking users into entering a code on a malicious site.
Sigma
