Microsoft 365 · Appelez le tech
No fake website, no stolen password, and yet the hacker gets into your mailbox. Device code phishing uses Microsoft’s real sign-in page to trick you into authorizing an intruder yourself. Here is how it works and how to block it.
Why talk about it now? A campaign spotted in February 2026 hit more than 340 Microsoft 365 organizations, including in Canada, in construction, real estate, law, healthcare and financial services. Turnkey kits sold to fraudsters now automate the attack.
First, what is a “device code”?
It’s a legitimate Microsoft feature. Some devices don’t have a keyboard or a convenient browser: a meeting room TV, a console, a command-line tool. The device displays a short code and asks you to go to microsoft.com/devicelogin on your phone or computer. You enter the code, sign in normally, and the device gets access to your account.
The problem: nothing guarantees that the “device” waiting for that code is yours.
How the attack works
- The hacker starts a “device code” sign-in themselves and gets a valid code, usually for about fifteen minutes.
- They send it to the target under a believable pretext: a Teams invitation, a DocuSign or SharePoint document to review, a voicemail, a call for tenders. Recent kits even display the code directly on a trap page generated on the fly.
- The victim goes to the real Microsoft page, enters the code, signs in and approves the MFA prompt.
- Microsoft hands the access tokens to the device that requested the code: the hacker’s. They read the email, search for words like “password” or “wire transfer,” and send new lures to your colleagues from your account.
The trap within the trap: MFA, even with a passkey, doesn’t stop this attack, because the victim really does authenticate on Microsoft’s site. And changing the password isn’t enough: tokens already issued stay valid until they’re revoked.
How to protect yourself
Never enter a code you didn’t ask for.
A legitimate device code only appears when you are setting up a device right in front of you: a meeting room TV, a console, a technical tool. Never in an email, a Teams message or a document.
For employees
- Be wary of any
microsoft.com/deviceloginor “Enter code” page that arrives through a link. - Read the confirmation screen: Microsoft shows the name of the app requesting access. If it isn’t what you’re setting up, stop.
- Entered a code by mistake? Call your IT support immediately, even late at night: every minute counts.
For the Microsoft 365 administrator
- Block the device code flow with Conditional Access (Entra ID P1, included in Microsoft 365 Business Premium): Entra > Protection > Conditional Access > New policy > Conditions > Authentication flows > Device code flow > Grant: Block access.
- Start in “report-only” mode and review the sign-in logs filtered on the Device code protocol to find legitimate uses (Teams Rooms, admin tools). Only exclude what’s documented, plus emergency access accounts.
- If device registration uses this flow, exclude the Device Registration Service from the policy.
- Limit who can register devices in Entra ID, and watch for unusual new registrations.
- Turn on sign-in risk policies and alerts on device code sign-ins.
If an account is compromised
Resetting the password isn’t enough. You need to revoke all of the user’s sessions, then check mailbox rules, registered devices and authorized apps:
# Microsoft Graph PowerShell
Connect-MgGraph -Scopes "User.RevokeSessions.All"
Revoke-MgUserSignInSession -UserId "user@yourdomain.com"No Entra ID P1 licence? Blocking through Conditional Access isn’t available. Employee training then becomes your main defence. It’s often a good reason to move to Microsoft 365 Business Premium.
Want to know whether the device code flow is blocked in your Microsoft 365?
Appelez le tech · 1 833 444-1041