Device codes exist so that TVs, meeting-room screens and command-line tools can sign in. The attacker starts a sign-in, gets a code, and sends it to the victim with a lure such as "enter this code to open the shared document."
Because the page is genuine and the person approves MFA themselves, address-bar checks and normal MFA do not stop it. Blocking device code sign-in with Conditional Access for everyone who does not need it does.
Signs to look for
- Sign-ins using the device code flow from people who never use it
- A device code sign-in followed by mailbox access from a new location
How Centeye handles it
Centeye Gatewatch spots the stolen session when the attacker starts using it, and ends it at your setting.
Gatewatch: identity protection (ITDR) →Go deeper: Device code phishing explained