{
  "id": "CB-M365-AUTH-022",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-022",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-022.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-022.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-022",
    "title": "Block device code flow",
    "finding": {
      "title": "Device code flow is allowed",
      "description": "Attackers send users a device code with a convincing pretext; once the user enters it on the real Microsoft page, the attacker receives tokens for the account, MFA included."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "conditional-access",
      "device-code",
      "authentication-flows",
      "phishing"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P1"
      ]
    },
    "description": "A Conditional Access policy for **All users** on **All resources** blocks the **Device code\nflow** authentication flow. The only exceptions are documented accounts that need it on\ndevices without a keyboard or browser, such as Microsoft Teams Rooms resource accounts, scoped\nto those accounts and ideally to their network location.\n\nThe Microsoft-managed policy **Block device code flow** satisfies this control once it is\n**On** with the same scope.\n",
    "rationale": "Device code phishing needs no fake page: the user signs in on the genuine Microsoft site,\npasses MFA and hands the session to the attacker. Campaigns using it against Microsoft 365 are\nfrequent, while legitimate use is rare and limited to specific devices.\n",
    "impact": "Command-line tools and devices that sign in with a device code stop working: Teams Rooms and\nother meeting devices, some printers, scripts using `az login --use-device-code` or similar.\nFind them in the sign-in logs (filter **Authentication protocol** = **Device code**) and exclude\nonly those accounts.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Entra ID** > **Conditional Access** > **Policies**.\n3. Find a policy with **State** set to **On** where **Users** includes **All users**\n   (exclusions limited to emergency access accounts and documented device accounts),\n   **Target resources** includes **All resources**, **Conditions** > **Authentication flows**\n   selects **Device code flow**, and **Grant** is **Block access**.\n4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n   `Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.AuthenticationFlows.TransferMethods -match 'deviceCodeFlow' } | Select-Object DisplayName, State, @{n='Grant';e={$_.GrantControls.BuiltInControls}}`\n5. Fail if no such policy exists, if it is Report-only or Off, or if it excludes users or\n   applications without a documented reason.\n"
    },
    "remediation": {
      "manual": "1. In **Entra ID** > **Monitoring & health** > **Sign-in logs**, filter **Authentication\n   protocol** on **Device code** for the last 30 days and list legitimate uses.\n2. As at least a Conditional Access Administrator, browse to **Entra ID** >\n   **Conditional Access** > **Policies**. Enable the Microsoft-managed **Block device code\n   flow** policy, or select **New policy**.\n3. **Users** > **Include**: **All users**. **Exclude**: the emergency access accounts and the\n   documented device accounts.\n4. **Target resources** > **Resources** > **Include**: **All resources**.\n5. **Conditions** > **Authentication flows**: **Configure** **Yes**, select **Device code\n   flow**.\n6. **Grant**: **Block access**.\n7. Set **Enable policy** to **Report-only**, review, then switch to **On**.\nGraph equivalent: `New-MgIdentityConditionalAccessPolicy` with\n`conditions.authenticationFlows.transferMethods` set to `deviceCodeFlow` and\n`grantControls.builtInControls` set to `block`.\n",
      "rollback": "Set the policy to **Report-only**, or exclude the account that needs device code flow.\n"
    },
    "references": [
      {
        "title": "Block authentication flows with Conditional Access policy",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/policy-block-authentication-flows",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Microsoft-managed policies",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/managed-policies",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Entra ID baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.3.9v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566.002"
      },
      {
        "framework": "mitre-attack",
        "id": "T1528"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-023",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-002",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-034",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}