Entra ID first-time device code flow sign-in (device code phishing)

ills3c Intel&Coffee@Ills3C

•updated 3 days ago•1•0•23

Detects successful Entra ID sign-ins using the device code authentication flow by users who have no prior device code sign-in history within a 30-day baseline window. This behavior can indicate device code phishing or abuse of the device code grant mechanism.