How to block device code flow in Microsoft Entra ID with Conditional Access

To block device code flow in Microsoft Entra ID, create a Conditional Access policy that covers all users and all resources, set the Authentication flows condition to Device code flow and choose Block access. Run it in report-only mode first, use the sign-in logs to find the devices and people that still rely on the flow, exclude only those, then switch the policy on. Tenants without Entra ID P1 can get a blanket block from security defaults instead.

The steps below follow Microsoft's documentation as of October 2026.

Why attackers abuse device code flow

Device code flow exists for hardware that cannot show a normal sign-in page, such as smart TVs, printers, IoT devices and meeting room systems. The device gets a short code from Entra ID, the user enters it in a browser on another device, and the tokens go back to the device. By default the code is valid for 15 minutes, according to Microsoft's protocol documentation.

In device code phishing, the attacker starts the flow and sends the code to the victim, often disguised as a meeting invite or shared file. The victim enters it at microsoft.com/devicelogin and signs in on a genuine Microsoft page, completing MFA if prompted, and the attacker's session receives the access and refresh tokens. No password is stolen, and because the page is real, the attack is hard to spot.

• Storm-2372: Microsoft's February 2025 report described fake Teams meeting invitations used since August 2024. The actor later used the Microsoft Authentication Broker client ID to register its own devices in Entra ID and obtain Primary Refresh Tokens.
• EvilTokens: a phishing-as-a-service platform launched in February 2026 that compromised more than 12,000 inboxes in over 10,000 organisations, according to Microsoft Threat Intelligence. On September 22, 2026, Microsoft announced a disruption of the service led by its Digital Crimes Unit.

Microsoft says few customers use the flow but attackers use it often, and it recommends blocking it wherever possible. Our Security section covered the EvilTokens takedown.

Before you start

Conditional Access needs Microsoft Entra ID P1 licences, and Microsoft 365 Business Premium customers can use it too, according to the Conditional Access overview. You need at least the Conditional Access Administrator role to create the policy and Reports Reader to read sign-in logs.

Check for the Microsoft-managed policy

Entra's what's new archive lists managed policies that limit device code flow as generally available in March 2025, and Microsoft deploys managed policies to tenants based on licensing and feature eligibility. In Entra ID > Conditional Access > Policies, look for Microsoft in the Created by column; managed policy names start with "Microsoft-managed:".

A managed policy starts in report-only mode, and Microsoft normally turns it on no less than 30 days later, with notice two weeks ahead. You can switch it on or off and exclude users, but other changes need a duplicate. Every applicable Conditional Access policy must be satisfied, so the managed original keeps blocking whoever it covers until you exclude them or turn it off.

Step 1: Find out who uses device code flow

Open Entra ID > Monitoring & health > Sign-in logs and set the Authentication protocol filter to device code. Check non-interactive sign-ins too, since they include token refreshes. Logs are kept for seven days on the free tier and 30 days with P1 or P2, per Microsoft's retention table, so a device that signs in rarely can be missed.

In Log Analytics, the SigninLogs and AADNonInteractiveUserSignInLogs tables record the protocol as deviceCode in AuthenticationProtocol and also have an OriginalTransferMethod column. The latter matters because of protocol tracking: a session that started with device code flow is still treated as one on later token refreshes.

Record the user, app, device and owner for each hit. Typical legitimate sources:

• Teams Rooms, Teams Android devices and other shared Teams devices, which use the flow for registration, reprovisioning and some reauthentication.
• Printers, digital signage and other IoT hardware.
• Admin tools: az login --use-device-code, Connect-AzAccount -UseDeviceAuthentication and Connect-MgGraph -UseDeviceCode. Azure CLI also falls back to device code flow when it cannot open a browser.

To check device registration, filter Resource ID for the Device Registration Service client ID, 01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9, with the device code protocol.

Step 2: Create the policy in report-only mode

Following Microsoft's policy guide:

1. Sign in to the Entra admin center as at least a Conditional Access Administrator and open Entra ID > Conditional Access > Policies > New policy.
2. Under Users or workload identities, include All users and exclude your emergency access accounts plus the exception groups from Step 3.
3. Under Target resources > Resources, include All resources. Exclude Device Registration Service only if Step 1 showed device registration through device code flow.
4. Under Conditions > Authentication flows, set Configure to Yes, select Device code flow, then Done.
5. Under Access controls > Grant, select Block access.
6. Set Enable policy to Report-only and select Create.

Step 3: Keep the exceptions narrow

Teams Rooms and other Teams devices

Microsoft's Teams devices guidance pairs the block with two exceptions: a persistent group holding only the resource accounts assigned to rooms and shared Teams devices, and the Device Registration Service exclusion. The group is permanent because these devices need the flow again after password or policy changes. Exceptions are per account, not per app, so keep technician and admin accounts out, record an owner and ticket for each member, and avoid broad user exclusions for personal Teams devices.

Admin tools and automation

Since version 2.61.0, Azure CLI signs in through the Web Account Manager broker on Windows and a browser on macOS and Linux by default, according to the Azure CLI documentation. For scripts and pipelines, Microsoft points to managed identities or workload identity federation. Remaining cases get their own small exception group with an owner and review date.

Device Registration Service

Authentication flows policies that target all resources have applied to the Device Registration Service since early September 2024. Exclude it only if you really register devices through device code flow: Storm-2372 used phished tokens to register devices of its own, and Microsoft also suggests limiting which users can enroll devices.

Step 4: Review the results and turn it on

Run report-only mode long enough to catch rarely used devices. Sign-ins the policy would block appear as Report-only: Failure in the sign-in details, and the Policy impact view summarises the past 24 hours, seven days or month. When only intended blocks remain, set Enable policy to On.

Because of protocol tracking, a device that once used the flow can later be blocked when it refreshes tokens, which Microsoft calls expected behaviour. Check Original transfer method in the sign-in details; with a policy on all resources, the error is AADSTS530036 and that refresh token is unusable for good. For a legitimate device, add its account to an exception group and sign it in again.

Blocking authentication transfer

The same condition offers Authentication transfer, which moves a signed-in state between devices, for example by scanning a QR code in desktop Outlook to sign in on a phone. Microsoft suggests blocking it if certain groups should not use Outlook on personal devices. Use a separate policy with that option selected and Block access.

How to block device code flow without Conditional Access

Free-tier tenants can use security defaults. As of October 2026, Microsoft lists blocking device code flow among their protections and says all new tenants created from July 1, 2026 block it this way. Security defaults are on or off with no exceptions, and they must be turned off before Conditional Access policies replace them. Older tenants should confirm in the sign-in logs that device code attempts fail.

If someone already entered a phishing code

Microsoft's EvilTokens guidance is to revoke the user's refresh tokens with revokeSignInSessions and temporarily disable the account, because access tokens already issued can stay valid for up to an hour. Look for devices registered soon after the sign-in and disable them, which stops their Primary Refresh Tokens, then check the mailbox for new inbox rules used to hide messages.

See also our Cloud section and our guide to finding Kerberos RC4 usage.

Frequently asked questions

What is device code phishing?

The attacker starts a legitimate device code sign-in and persuades the victim to enter the code on Microsoft's real sign-in page. The victim's sign-in then authorises the attacker's session, which receives tokens without ever seeing a password.

Does MFA stop device code phishing?

Not on its own, because the victim signs in and completes any MFA prompt on the genuine Microsoft page, and the tokens go to the attacker. Microsoft describes the technique as a way around traditional MFA and recommends blocking the flow itself.

Will blocking device code flow break Teams Rooms?

It can, because Teams Rooms and other Teams devices use the flow for registration and some reauthentication. Microsoft's answer is a persistent exception group for their resource accounts plus a Device Registration Service exclusion.

Can I block device code flow without Entra ID P1?

Yes, with security defaults, which Microsoft lists as blocking device code flow as of October 2026. They allow no exceptions, so if anything still needs the flow you need Conditional Access with P1 or Microsoft 365 Business Premium.

What is the difference between device code flow and authentication transfer?

Device code flow signs in a device after the user enters a short code elsewhere; authentication transfer moves an existing signed-in state to another device, for example through an Outlook QR code. Both sit in the same Authentication flows condition and can be blocked separately.