Device-code sign-in followed by suspicious device registration
Detects instances where a user authenticates via the OAuth 2.0 device code flow followed shortly by a new device registration. The rule flags registrations where the device name shape is uncommon compared to historical data or where there is a mismatch between the IP address used for the authentication and the registration, indicating potential device code phishing or account takeover.
Microsoft Sentinel (KQL)
