Device code phishing works because nothing about it looks fake. The victim visits a genuine Microsoft page, types a code they were sent, signs in with their real password and approves a real multi-factor prompt. The attacker collects the tokens at the other end. There is no lookalike domain to spot, which is why user training performs poorly against it and configuration does the heavy lifting.
How the flow was meant to work
The device code flow exists for hardware that cannot show a browser, such as a smart television, a conference room display or a command line tool on a server. The device shows a short code, the user opens the sign-in page on a phone or laptop, enters the code, and the device receives tokens once authentication completes. It is a sensible design for its purpose. The weakness is that the code carries no binding to the device that requested it, so anyone who can persuade a user to enter their code receives the resulting tokens, including a refresh token that keeps working long after the session that produced it.
What the attack looks like from the inside
An attacker starts the flow, receives a code that lasts around fifteen minutes, and sends it out with a plausible reason. Recent campaigns have used invitations to join a Teams meeting or to connect to a shared document, often sent from a compromised mailbox at a supplier so the message arrives on a real thread. The user enters the code, completes multi-factor authentication, and the attacker’s tokens arrive. From there the account is readable, mailbox rules can be created, and the refresh token allows quiet return visits. Microsoft’s threat intelligence teams documented an extended campaign using exactly this technique through 2025.
“This is the attack that makes people realise multi-factor authentication is a control rather than an answer. The user did everything right, including approving a prompt they genuinely triggered. If your defence rests on staff spotting a bad link, you have no defence here, because there is no bad link to spot.”
William Fieldhouse, Director, Aardwolf Security Ltd
The configuration that stops it
Block the device code flow with Conditional Access unless you have a documented need for it. Entra ID exposes authentication flows as a condition, so you can deny the device code grant for all users and then permit it for a small group covering the meeting room hardware or engineering tools that require it. Pair that with phishing-resistant multi-factor authentication, which CISA set out in its October 2022 fact sheet on implementing phishing-resistant MFA, since a hardware key or passkey is bound to the site and does not travel with a code. Add token protection where your licensing supports it, and shorten sign-in session lifetimes for administrative roles.
Detecting the attempts you did not block
Look for sign-in events using the device code flow from an unfamiliar location, since your legitimate uses of it are few and predictable. Alert on any success where the sign-in protocol is device code and the device is not one you manage. After a confirmed case, revoke refresh tokens for the account rather than only resetting the password, because a password change alone leaves the existing tokens valid. Reviewing this properly is part of Azure tenant penetration testing, and if you are shortlisting penetration testing specialists for identity work, ask them to demonstrate the flow against a test account so your team can see what the alerts look like.
Frequently asked questions about device code phishing
These come up whenever a tenant review reaches the topic of multi-factor authentication.
Does blocking the flow break anything?
Rarely. Most organisations use it for a handful of devices and tools. Turn on reporting first, see who genuinely uses it over a fortnight, then block everyone else.
Would a passkey have prevented this?
Yes, for the account that holds it, because the credential is tied to the legitimate site and cannot be replayed elsewhere. That is the practical argument for moving privileged users to phishing-resistant methods first.
