Skip to content
Cyber Security

Device code phishing: how a real Microsoft sign-in gives access away

How device code phishing tricks staff into approving an attacker's Microsoft 365 sign-in on the real Microsoft page, and the policy that blocks it.

Geidi Security Operations Team6 min read

In brief

What it is
Device code phishing gets staff to enter a code on the real Microsoft sign-in page, which approves an attacker's session in their mailbox.
Who it affects
Any Microsoft 365 organisation: the page, the padlock and the MFA prompt are all genuine, so the usual checks pass.
What to do
Find who genuinely uses device code sign-in, then block it for everyone else with a Conditional Access policy.
On this page
  1. How it works
  2. Are you affected?
  3. How to fix it
  4. If you think it already happened
  5. Where Geidi fits
  6. Sources

An email arrives about a Teams meeting, an invoice or a password that's about to expire. It gives a short code and a link to microsoft.com/devicelogin. The page really is Microsoft's. The person types the code, signs in, approves the MFA prompt, and nothing much seems to happen. Meanwhile an attacker somewhere else now has a working session in their mailbox.

That's device code phishing. It is nasty because every check we teach people passes: the address is genuine, the padlock is there, MFA fired as normal. The person hasn't typed their password into a fake site. They have simply approved someone else's sign-in.

The good news is that most organisations can switch the underlying feature off with one Conditional Access policy.

How it works

Device code sign-in is a legitimate Microsoft feature for things that don't have a proper keyboard, such as a meeting room screen, a smart TV or a printer. The device shows a code, you enter it on your phone or laptop, and the device gets signed in.

The attack turns that around. The attacker starts the sign-in from their own computer, gets the code, and sends it to your staff member dressed up as something routine. When the staff member enters the code and signs in, the tokens go to the attacker's session. From there they can read mail, search it, and send more phishing from a trusted internal address.

Microsoft has been reporting on this for a while:

  • In February 2025 it described a group it calls Storm-2372, which it assessed as aligned with Russian interests, running device code phishing since August 2024. The group built rapport over WhatsApp, Signal and Teams, then sent fake Teams meeting invitations where the "meeting ID" was the device code. Once in, it searched mailboxes for words like "password" and "admin" and took copies of what it found.
  • Within a day of that report, Microsoft saw the group switch to a technique that let it register its own device in the victim's Entra ID tenant, a much more durable foothold.
  • In April 2026 Microsoft described a far bigger campaign using AI-written lures matched to people's jobs. Codes normally expire after 15 minutes, so the attackers generated each one only at the moment the person clicked the link.
  • In September 2026 Microsoft linked that activity to a criminal phishing-as-a-service kit called EvilTokens, which it says was used to compromise more than 12,000 inboxes in over 10,000 organisations worldwide.

So this has moved from a spy technique to something any criminal can rent.

Are you affected?

If you use Microsoft 365 and haven't deliberately blocked device code sign-in, the door is open. It's on by default.

The honest question is whether anyone actually uses it. Microsoft's own documentation says device code flow is rarely used by customers but frequently used by attackers. Typical legitimate uses are Teams Rooms and other meeting room devices, some shared screens, and occasionally an admin tool that signs in from a command line.

Your IT team can check before changing anything. In the Entra sign-in logs, filter the authentication protocol to device code flow and look at a month or two of history.

How to fix it

  1. Look at who uses device code sign-in today, using the sign-in log filter above, and list the accounts and devices that genuinely need it.
  2. Create a Conditional Access policy that blocks it. In the Microsoft Entra admin center, go to Entra ID, Conditional Access, Policies, New policy. Include all users, exclude your emergency (break-glass) accounts, target all resources, and under Conditions, Authentication flows, select Device code flow. Set the grant control to Block access.
  3. Start in report-only mode, check the results for a week, then switch it on.
  4. Carve out genuine exceptions narrowly. If Teams Rooms devices need device code sign-in, Microsoft's guidance is to exclude only the specific Teams device resource accounts (kept in their own group), not whole groups of people, and to exclude the Device Registration Service resource from the policy.
  5. Check whether Microsoft already did it for you. Microsoft deploys a set of managed Conditional Access policies to eligible tenants, and one of them is called "Block device code flow". It shows "Microsoft" in the Created by column. If yours is sitting in report-only mode, review it and turn it on.

Conditional Access needs Microsoft Entra ID P1, which comes with Microsoft 365 Business Premium. If you don't have it, that's a good reason to look at your licensing.

A few supporting settings help too: a sign-in risk policy can challenge or block suspicious sign-ins, and phishing-resistant MFA shuts the related fake-login-page route. On its own it doesn't stop device code phishing, though, because the person really is signing in on Microsoft's page. Our article on adversary-in-the-middle phishing covers that last point, and the OAuth consent phishing article covers a close cousin of this attack.

Tell staff one plain thing: if an email, chat or caller gives you a code to enter on a Microsoft page, stop and ask IT. Real meeting invitations never need it.

If you think it already happened

Act the same day. These attackers work fast and by hand.

  • Revoke the person's sessions (in Entra, open the user and select Revoke sessions). Microsoft notes that access tokens last an hour by default, so an attacker may keep some access for a short while after that. Its guidance also covers disabling the account, which is worth doing while you investigate.
  • Reset the password and check their MFA methods for anything recently added.
  • Check the mailbox for new inbox rules and forwarding, which attackers use to hide replies and keep reading mail.
  • Look in Entra for devices registered to the user that nobody recognises, and remove them.
  • Warn anyone who received mail from the account while it was compromised.

Report it to ASD's ACSC at cyber.gov.au (opens in a new tab) ("Cybercrime" for most businesses, "Cyber security incident" for organisations with 250 or more staff, government and critical infrastructure) or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371). If personal information in the mailbox was likely accessed, check whether the Notifiable Data Breaches scheme applies.

Where Geidi fits

Our cyber security services are aligned to the Essential Eight and backed by a 24/7 security operations centre. If you'd like to talk about device code phishing, get in touch.

Sources

More on Cyber Security

One partner for the whole environment.

Tell us about your existing IT. We would be pleased to review your current system and give you an overview as to how Geidi may be able to deliver and enhance your IT operations.

Book a consultationCall 1300 855 049