Microsoft 365 Device Code Defense
Device code phishing against Microsoft 365, how the attack inverts a legitimate OAuth flow
The victim authenticates to the real Microsoft sign-in page. MFA satisfies normally. FIDO2 does not stop it. The …
Microsoft 365 Device Code Defense
Detecting device code phishing in Microsoft Sentinel, one field, one rule
Every successful device code sign-in writes `AuthenticationProtocol == deviceCode` to SigninLogs. Normal users almost never trigger this. The …
Microsoft 365 Device Code Defense
Blocking device code phishing in Microsoft 365, the CA policy that closes the flow
One Conditional Access policy blocks the entire device code flow. Most tenants have never deployed it. Here is …
Microsoft 365 Device Code Defense
Device code phishing incident response, what to do when you find a sign-in you cannot explain
A device code sign-in in SigninLogs that nobody authorized. The attacker has had a 90-day refresh token since …