OAuth Device Code Authentication Flow Sign-In (Entra ID)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects the use of the OAuth device code authentication flow in Azure AD/Entra ID sign-in events. This flow is frequently abused by attackers who use vishing or SMS phishing pretexts to trick users into authorizing a device login, enabling the attacker to obtain a valid session token without direct credential harvesting or cookie theft.