Device code flow sign-in followed by token use from a different IP

Adarsh Pandey@Pandeyadarsh

•updated yesterday•0•0•0

Detects Microsoft Entra ID (Azure AD) sign-ins using the OAuth 2.0 device code flow from an IP address that the user has not previously used for non-device code authentication. This behavior can indicate device code phishing or session hijacking attempts.