Entra ID device code flow sign-in from unregistered or non-compliant device
Detects successful Azure Active Directory (Entra ID) sign-ins using the device code flow where the originating device is neither registered nor trusted (managed or compliant), which may indicate suspicious authentication attempts or token abuse.
Splunk (SPL)
