Block device code flow

Description

A Conditional Access policy for All users on All resources blocks the Device code flow authentication flow. The only exceptions are documented accounts that need it on devices without a keyboard or browser, such as Microsoft Teams Rooms resource accounts, scoped to those accounts and ideally to their network location.

The Microsoft-managed policy Block device code flow satisfies this control once it is On with the same scope.

Rationale

Device code phishing needs no fake page: the user signs in on the genuine Microsoft site, passes MFA and hands the session to the attacker. Campaigns using it against Microsoft 365 are frequent, while legitimate use is rare and limited to specific devices.

Impact

Command-line tools and devices that sign in with a device code stop working: Teams Rooms and other meeting devices, some printers, scripts using az login --use-device-code or similar. Find them in the sign-in logs (filter Authentication protocol = Device code) and exclude only those accounts.

Applies when

Requires: Microsoft Entra ID P1

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
2. Browse to Entra ID > Conditional Access > Policies.
3. Find a policy with State set to On where Users includes All users (exclusions limited to emergency access accounts and documented device accounts), Target resources includes All resources, Conditions > Authentication flows selects Device code flow, and Grant is Block access.
4. Read-only alternative with Microsoft Graph PowerShell (scope Policy.Read.All): Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.AuthenticationFlows.TransferMethods -match 'deviceCodeFlow' } | Select-Object DisplayName, State, @{n='Grant';e={$_.GrantControls.BuiltInControls}}
5. Fail if no such policy exists, if it is Report-only or Off, or if it excludes users or applications without a documented reason.

Remediation

1. In Entra ID > Monitoring & health > Sign-in logs, filter Authentication protocol on Device code for the last 30 days and list legitimate uses.
2. As at least a Conditional Access Administrator, browse to Entra ID > Conditional Access > Policies. Enable the Microsoft-managed Block device code flow policy, or select New policy.
3. Users > Include: All users. Exclude: the emergency access accounts and the documented device accounts.
4. Target resources > Resources > Include: All resources.
5. Conditions > Authentication flows: Configure Yes, select Device code flow.
6. Grant: Block access.
7. Set Enable policy to Report-only, review, then switch to On. Graph equivalent: New-MgIdentityConditionalAccessPolicy with conditions.authenticationFlows.transferMethods set to deviceCodeFlow and grantControls.builtInControls set to block.

Rollback

Set the policy to Report-only, or exclude the account that needs device code flow.

References

• Block authentication flows with Conditional Access policy Microsoft, vendor-doc, accessed 2026-10-24
• Microsoft-managed policies Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Entra ID baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-023 Block authentication transfer
• related CB-M365-ADMIN-002 Keep two protected emergency access accounts
• related CB-M365-AUTH-034 Keep Conditional Access policies free of broken references and unprotected exclusions

People and lifecycle