Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

Block Device Code Flow Authentication [CHK-1172]

This check verifies if Device Code Flow authentication is blocked through Conditional Access policies.

Rationale

Device Code Flow authentication allows devices where traditional authentication doesn't work, such as Smart TVs and IoT devices, to sign in to Microsoft 365. However, this feature can be exploited by cybercriminals to gain and/or maintain access to an account.

Fix

An automated fix is available through Attic.

Manual steps:

  1. Navigate to the Entra admin center at https://entra.microsoft.com
  2. Go to Protection > Conditional Access > Policies
  3. Click New Policy
  4. Under Assignments, select Users or workload identities > Include > All users
  5. Under Target resources > Resources (formerly cloud apps) > Include, select All resources
  6. Under Conditions > Authentication flows, set Configure to Yes and select Device code flow
  7. Under Access controls > Grant, select Block access
  8. Confirm the settings and set Enable Policy to Report-Only
  9. Click Create to enable the policy

Impact

Blocking Device Code Flow authentication reduces the risk of phishing attacks and potential account compromise.

More Information