Check ID: entra_conditional_access_policy_device_code_flow_blocked
Provider: Microsoft 365
Service: entra
Severity: HIGH
Categories: identity-access, trust-boundaries, e3
Resource type: NotDefined

​
What this check verifies

Conditional Access policies restrict the device code authentication flow, which is commonly abused in phishing campaigns to hijack user sessions. A policy targeting deviceCodeFlow in authentication flow conditions with a block grant control prevents this attack vector.

​
Risk

Device code flow is heavily exploited in phishing attacks such as Storm-2372, where attackers trick users into entering device codes on legitimate Microsoft login pages. Without a blocking policy, attackers can obtain tokens and gain persistent access to organizational resources.

​
Recommendation

Block device code flow via Conditional Access to mitigate phishing attacks that abuse this authentication method. Exclude only break-glass accounts and legitimate service accounts that require device code flow. Regularly review exceptions to minimize the attack surface.

​
Remediation

Dashboard steps
  1. Navigate to the Microsoft Entra admin center at https://entra.microsoft.com.
  2. Expand Protection > Conditional Access and select Policies.
  3. Click New policy.
  4. Under Users, include All users and exclude break-glass accounts.
  5. Under Target resources, include All cloud apps.
  6. Under Conditions > Authentication flows, select Device code flow.
  7. Under Grant, select Block access.
  8. Set the policy to On and click Create.

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_conditional_access_policy_device_code_flow_blocked. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks