Best Detection of 2026 Series: Device Code Phishing Bypass of Passkey/FIDO2 MFA
Detects instances where a user successfully authenticates via the OAuth Device Code flow using an unmanaged or non-compliant device, followed closely by high-privileged Azure/Graph API administrative actions within a short timeframe. This behavior is indicative of a device-code phishing attack aimed at bypassing MFA controls, including FIDO2/passkeys, by compromising an active session.
Microsoft Sentinel (KQL)
