Most phishing training teaches your team one habit: check the login page. Read the address bar, look for the padlock, and if the Microsoft sign-in screen looks off, walk away. Device code phishing defeats that habit. The login page is the real one, hosted by Microsoft. The code your employee types is a real code. Multi-factor authentication runs and passes. At the end of it, an attacker holds a valid session for your employee's account.
This attack matters most for businesses that run on Microsoft 365 and Microsoft Entra ID, which covers most of them. Below is how it works, how your team can spot it, and how to switch it off across your tenant.
What Device Code Sign-In Is For
Microsoft built device code sign-in to solve a genuine problem. Some devices make typing a username and password awkward or impossible: a meeting-room display, a printer, a smart TV, a command-line tool. Rather than force a full login on a device with no proper keyboard, Microsoft shows a short code and a web address, usually microsoft.com/devicelogin. You open that address on your phone or laptop, enter the code, sign in with your normal credentials and MFA, and Microsoft links the device to your account.
It is a legitimate feature, switched on by default, and used across Microsoft environments every day. That is exactly why attackers reach for it.
How Attackers Turn It Against You
The attacker starts a device code login of their own, pointed at your organisation's Microsoft tenant. Microsoft hands them a genuine code and gives them a short window to use it. All they need now is for one of your employees to enter that code on the real Microsoft page.
So they send it over. An email or a Teams message arrives dressed as a meeting invite, a security check, or an IT prompt, carrying the code and a friendly instruction to "enter this to join" or "verify your account." Your employee opens microsoft.com/devicelogin, types the code, signs in, and clears the MFA prompt. From their side, nothing looks wrong. What they have actually done is approve the attacker's device. Microsoft issues the attacker a valid access token, and they walk into the mailbox, the files, and the Teams history.
The attack used no fake website and stole no password. Your employee's own approval did all the work. In early 2025, Microsoft tracked a state-aligned group it calls Storm-2372 running this exact play against governments, NGOs, and businesses, using fake Teams and messaging-app invitations to deliver the codes.
Why It Slips Past Your Usual Checks
Every instinct your team has been trained to use points the wrong way here. The sign-in page is genuine Microsoft. The code is genuine. There is no lookalike domain to catch and no cloned portal to report. MFA runs and passes, because your employee really does complete it.
For the person at the keyboard, the whole thing reads as a normal Microsoft login. For your security tooling, a valid sign-in backed by valid MFA is what a legitimate login looks like. The access holds until someone revokes the session or the token expires on its own.
Why this beats MFA: multi-factor authentication protects the moment of login. Device code phishing has your employee complete that login for the attacker, then hands the resulting session across. The password works and the MFA prompt works. That is the whole point of the technique.
How to Spot It
The tell is the context, not the page. A real Microsoft sign-in screen asking for a device code you never requested is the thing to distrust. Watch for:
- A request to enter a Microsoft device code when you did not start a sign-in yourself
- A code that arrives by email or chat alongside pressure to act now
- A message telling you to verify, reauthorise, or fix your account with no prior warning
- A device-code prompt attached to a meeting invite or file you were not expecting
Microsoft does not send you a device code out of the blue and ask you to approve it. If a code turns up unrequested, treat it as hostile.
What Your Team Should Do
The rule is short: if you did not start it, do not approve it. When a device code request feels out of place, stop and confirm it through a channel you trust, a direct call or message to your IT provider or to the colleague who supposedly sent it. A code expires quickly, so pausing costs you nothing. Report the message too, so your IT team can check whether anyone else received the same thing.
How to Shut It Off Across Your Tenant
Awareness catches some of these attacks. You can remove most of the risk in the admin centre. Microsoft Entra ID lets you control the device code flow directly, and for the large majority of businesses the right setting is to block it.
Most organisations never legitimately use device code sign-in. The meeting-room screens and command-line tools that need it are a small, known list. So you turn the flow off for everyone with a Conditional Access policy, then allow it back for the handful of accounts or devices that genuinely require it. With the flow blocked, a code sent to your employee will not complete, and the attack dies before it starts.
KAVIX handles this as part of hardening a Microsoft 365 tenant:
- Set a Conditional Access policy that blocks the device code authentication flow for all users by default
- Allow it back only for the specific devices or service accounts that need it
- Turn on sign-in monitoring that flags unexpected device-code grants and new device registrations
- Keep session revocation ready, so a suspected approval gets cut off in minutes rather than days
The short version: device code phishing works because it borrows a real Microsoft feature. Teach your team to distrust any code they did not ask for, block the device code flow in Entra ID for everyone who does not need it, and watch your sign-in logs for the grants that get through. Awareness handles some of it. The Conditional Access policy handles the rest.
Is the device code flow open on your Microsoft 365 tenant?
Most businesses have never checked. KAVIX reviews your Microsoft 365 and Entra ID configuration, blocks the attack paths that do not need to be open, and sets up monitoring for the sign-in behaviour that matters. If you would like us to look at your tenant, get in touch. It is a free conversation.
Talk to Us About M365 SecuritySummary
Device code phishing is a clean example of a modern identity attack. It steals no password, breaks no encryption, and never shows your team a fake page. It borrows a genuine Microsoft workflow and waits for one person to approve a code they did not request.
The defence pairs the human with the technical. Tell your people that an unexpected device code is a red flag, and set your tenant so the flow they would be approving is switched off in the first place. Most businesses on Microsoft 365 have never checked whether that flow is open. Ten minutes finding out is worth it.