Entra ID Device Code Flow Sign-In Followed by Token Use from a Different IP
Detects potential device-code phishing attacks where a user successfully authenticates using the device code flow from one IP address, followed shortly by a successful sign-in from a different IP address using the same user account, indicating an attacker has redeemed the stolen device code token.
Microsoft Sentinel (KQL)
