Successful Device Code Authentication via microsoft.com/devicelogin

Smarth Arora@smarthxarora

•updated Jul 6, 2026•4•0•10

Detects successful authentication events in Azure SigninLogs that utilize the Device Code OAuth flow. Attackers may leverage this flow in phishing campaigns or to bypass MFA by tricking users into authorizing malicious devices, which can lead to subsequent token theft.