Device code flow sign-in followed by sign-in from different IP (token collection
Detects a successful device code flow sign-in followed within one hour by a successful sign-in from the same user using a different IP address and country. This pattern can indicate device code phishing or abuse of the OAuth 2.0 device authorization grant flow.
Microsoft Sentinel (KQL)
