How to Detect and Block Device Code Flow in Entra Before it Costs you a Tenant

Device code flow attacks are exploding across Microsoft 365 environments in 2025, and they bypass many of the security controls organizations rely on, including FIDO2 keys, MFA, and Conditional Access. In this episode of Demystifying Microsoft, host Nathan Taylor breaks down exactly how these attacks work, why threat actor groups like Storm-2372 are leveraging phishing-as-a-service kits like Kali365, Octopi365, FlowerStorm, and EvilTokens to industrialize the attack, as well as how to detect and block device code phishing in your own tenant.

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at the Sourcepass Center of Excellence for Microsoft. With more than 20 years of experience supporting small and mid-sized organizations, Nathan brings a pragmatic perspective shaped by real-world deployments, Microsoft 365 security strategy, and close collaboration with Microsoft. He helps IT leaders cut through the noise of an ever-evolving Microsoft ecosystem so they can make informed, defensible decisions with confidence.

A legitimate Microsoft authentication method built for conference room PCs, digital signage, and devices without a proper keyboard or browser.

The victim completes a fully legitimate Microsoft login on their trusted device, passing MFA and FIDO2 checks, then hands the resulting token to the attacker.

The Storm-2372 threat actor group is driving this attack through WhatsApp, Signal, and Microsoft Teams messages. Phishing-as-a-service kits like Kali365, Octopi365, Freedom365, and EvilTokens have industrialized the attack and made it accessible to low-skill actors.

Go to entra.microsoft.com → Users → Sign-in logs, set the range to one month, and filter by authentication protocol. Always run this audit before deploying a block policy to avoid breaking legitimate logins.

Create a new CA policy targeting all users and all resources, add the authentication flows condition for the device code flow, and set the grant control to block access. A five-minute change that hardens every tenant.

For conference room PCs, kiosks, or scripts that genuinely need device code flow, exclude the specific account and layer compensating controls: lock it to a single office IP, require phishing-resistant MFA, or require an Entra hybrid joined compliant device.

Blocking device code flow doesn’t cover every attack path. An Identity Threat Detection and Response tool monitors sign-in behavior 24/7, catches unusual token activity, and can lock accounts before attackers exfiltrate data via Graph API.

Still figuring out whether your tenant is exposed to device code flow attacks or which conditional access policies you actually need? Connect with the Sourcepass MCOE team to build a Microsoft 365 security posture that blocks tomorrow’s attack vectors before they hit: https://sourcepassmcoe.com/demystifying-microsoft-contact 

Nathan Taylor on LinkedIn

Demystifying Microsoft is handcrafted by our friends over at: fame.so