Device code phishing: the Microsoft 365 attack that gets past MFA (and how to switch it off)
Device code phishing gets past MFA and even passkeys in Microsoft 365. See how it works, what ASD warned in 2026, and the Conditional Access fix that stops it.
Device code phishing gets someone to type an attacker's short code into Microsoft's real device sign-in page, then complete their usual password and MFA. That approval signs the attacker's own device into their Microsoft 365 account, with no fake website involved, so MFA doesn't stop it. A Conditional Access policy that blocks the device code flow for every account that doesn't need it does.
On 16 May 2026 the Australian Signals Directorate (ASD) warned it had received a number of reports of this technique being used on Microsoft 365 users.
What is device code phishing?
It abuses a real Microsoft sign-in feature for screens without a keyboard: smart TVs, printers and Teams Room devices show a short code, and you sign in for them in a browser on your phone or laptop. Microsoft's documentation says the flow "is rarely used by customers, but is frequently used by attackers". The attack has four steps:
The attacker asks Microsoft for a code.
They start a genuine device sign-in from their own machine and get a short code linked to it.
A lure arrives.
An email, PDF or chat message mentions a shared document, something to e-sign, a waiting voicemail or an expiring password, and asks the person to verify with the code.
The victim enters the code on the real Microsoft page.
They paste it into Microsoft's genuine device login page and sign in with their usual password and MFA.
The attacker's device is approved.
Microsoft hands access and refresh tokens to the device that requested the code. In ASD's words, the attacker can now "act as the victim without needing to input a password or MFA again".
Device codes expire after 15 minutes by default, which used to limit the attack. ASD says criminals now use "automated systems and AI to request legitimate fresh codes" at the moment someone clicks, and Microsoft's researchers traced a 2026 campaign whose landing page generated a fresh code and often copied it straight to the victim's clipboard. Jargon check: our IT and cyber security glossary explains token theft and Conditional Access.
Why doesn't MFA stop device code phishing?
Because the victim completes MFA themselves, on Microsoft's real site, and nothing is stolen. ASD is blunt: the technique "doesn't steal passwords or multi-factor authentication (MFA) codes. Nor is it a technical flaw in Microsoft systems."
That's why the popular line that "passkeys fix it" is wrong. Passkeys defeat fake login pages, because a passkey only answers the genuine site it was made for. Here the site is genuine, so the passkey works perfectly and approves the attacker's session. Push Security's research agrees: the device code authorisation happens after login, so no form of MFA, passkeys included, prevents it. Passkeys still stop the fake-page attacks and are well worth rolling out; they just leave this door open.
| Control | Stops device code phishing? | Why |
|---|---|---|
| Standard MFA (app approval or SMS code) | No | The victim completes it genuinely. |
| Passkeys and phishing-resistant MFA | No, not on their own | The page is genuine, so there's nothing to refuse. |
| Email filtering | Partly | Lures are bounced through compromised sites and cloud platforms to dodge scanners. |
| Conditional Access blocking device code flow | Yes, for every account in scope | Microsoft refuses the sign-in, so no tokens reach the attacker. |
| Requiring compliant or registered devices | A useful second layer | Proofpoint recommends it as defence in depth, though expect more exceptions. |
| Staff awareness | Helps | Staff who never enter a code they didn't request stop at step three. |
Is device code phishing hitting Australian businesses?
Yes. ASD's warning was prompted by reports it received, and it urged organisations to "explore policy-based identity controls such as Conditional Access and anti-phishing policies". The wider figures come from security vendors, so treat them as indicators:
- Huntress tracked a campaign that reached more than 340 Microsoft 365 organisations in five countries, including Australia, in February and March 2026, hitting construction and law firms hardest.
- Barracuda reported in April 2026 that it had detected more than 7 million device code phishing attacks in the previous four weeks.
- Proofpoint links the surge to criminal toolkits published from late 2025. EvilTokens, which Push Security calls the most prevalent kit, was first advertised on Telegram in February 2026.
In the campaign Microsoft analysed, attackers registered new devices, created malicious inbox rules or copied out email, focusing on finance, executive and admin staff. Quiet access to a finance mailbox is exactly what a payment redirection scam needs.
How do you block device code flow in Microsoft 365?
With a Conditional Access policy that blocks the device code authentication flow, built after you've found who legitimately uses it. Microsoft's authentication flows guidance says to allow the flow only where necessary and block it "wherever possible". Order matters, because blocking blind can knock a meeting-room device offline:
Confirm you can use Conditional Access.
It requires Microsoft Entra ID P1, which Business Premium includes (compare the plans). Basic and Standard tenants can buy P1 on its own; Microsoft's Australian pricing lists it at A$10.50 per user per month, paid yearly on an annual commitment (checked 15 October 2026).
Look for Microsoft's own policy.
Microsoft deploys a managed policy called "Block device code flow" to eligible tenants. It arrives in report-only mode, and Microsoft normally switches it on at least 30 days later, after notifying admins, unless someone changes it. Check whether it's there and that nobody has set it to Off.
Audit legitimate use.
In the Microsoft Entra admin center, open Entra ID > Monitoring & health > Sign-in logs and filter Authentication protocol for device code. Expect Teams Rooms and shared Teams devices, kiosk or signage screens, and admin tools such as the Azure CLI. Without P1, sign-in logs only keep seven days, so review a full month once you can.
Build narrow exceptions.
Put genuine Teams device resource accounts in an exception group, document any other approved use with an owner, and exclude your break-glass accounts. Microsoft's Teams device guidance warns that an excluded account can use device code sign-in for any app, so never add broad groups of staff, and exclude the Device Registration Service so devices can still register.
Create the policy in report-only mode.
All users, all resources, Conditions > Authentication flows > Device code flow, Grant > Block access, as Microsoft's instructions set out. It's the same test-first method we use when retiring legacy authentication.
Review, then switch it on.
Check the report-only results, then set the policy to On. Devices originally signed in with a device code may be signed out, so keep an eye on them.
Add second layers.
Require compliant devices for staff sign-ins, turn on Defender for Office 365 anti-phishing policies and Safe Links as part of your email security, and brief your staff.
How do you spot device code phishing in the sign-in logs?
Filter for the device code authentication protocol, then ask whether the person, app and location make sense. A bookkeeper has no reason to sign in with a device code; a Teams Room account does. Microsoft's guidance is to alert on unexpected use by privileged users, emergency access accounts, unfamiliar apps or unexpected locations. After any unexplained one, look for new inbox rules, devices or mail forwarding.
Key IT's 24/7 SOC service monitors Microsoft 365 sign-ins, MFA activity, mailbox rules and privilege changes for our managed clients, so unusual sign-in activity is looked into rather than left sitting in a log.
What if someone has already entered a code?
Treat it as a compromised account. Microsoft's incident advice is to revoke the user's sign-in sessions and temporarily disable the account, because access tokens already issued can stay valid for up to an hour. Don't rely on a password reset alone: under Microsoft's token revocation rules, some refresh tokens survive a password change, while revoking sessions cancels them all. Remove any devices nobody recognises from the account, then follow our guide to a hacked Microsoft 365 account.
What should staff be told about device codes?
One rule: only enter a Microsoft sign-in code that's showing on a device you are setting up yourself, right in front of you. If a code arrives in an email, Teams chat, PDF or web page, don't enter it, and tell IT. ASD's version: "Never approve a sign-in you did not personally initiate."
The usual checks fail here: the link really goes to microsoft.com and the MFA prompt is real. AI-written lures already removed the spelling mistakes; this removes the fake website too. Teach staff to stop at:
- A "verify your identity" button leading to a Microsoft page that asks for a code.
- A code already copied to their clipboard, ready to paste.
- A sign-in screen naming an app or device they didn't open.
- Urgency around shared documents, invoices, voicemails or security alerts.
Keep reporting blame-free, so whoever typed a code says so early. Regular phishing simulation keeps the rule front of mind.
Frequently asked questions
Is device code phishing a flaw in Microsoft 365?
No. ASD is explicit that it isn't a technical flaw in Microsoft systems. Device code sign-in is a legitimate feature for smart TVs, printers and meeting-room devices. Attackers abuse it by persuading a real person to approve their device, so the fix is a configuration change in your own tenant, not a Microsoft patch.
Will blocking device code flow break anything?
It can if you skip the audit. Teams Rooms and shared Teams devices use device code sign-in for setup and some re-authentication, and admin tools such as the Azure CLI may rely on it. Check the sign-in logs, give genuine devices a narrow exception and run the policy in report-only mode first. Most staff won't notice.
Which Microsoft 365 licence do we need to block device code flow?
You need Conditional Access, which requires Microsoft Entra ID P1. Business Premium includes it; Business Basic and Standard don't, so those tenants either add P1 licences or move to Premium. Premium also brings Intune for the compliant-device requirement, the natural second layer.
Can device code phishing target apps other than Microsoft 365?
Yes. Push Security notes that any app supporting device code logins can be targeted, naming Google, Salesforce, GitHub and AWS alongside Microsoft. Microsoft is by far the most targeted, so start there. If you use other cloud platforms, ask each vendor how device code login is controlled.
How do we know if we've already been hit?
Filter your Entra ID sign-in logs on the device code authentication protocol and review every result from the past 30 days, or seven without P1. Any device code sign-in by a person, rather than a meeting-room or shared-device account, needs an explanation. Check those accounts for new inbox rules and devices, or ask us to look.
More insights
M365 account hacked: first-hour checklist
Microsoft 365 account hacked or clicked a phishing link? The first-hour checklist, the hidden inbox…
Read article →PhishingCould you spot a phishing email?
How to spot a phishing email: the red flags staff miss, real examples (fake Microsoft 365 logins…
Read article →Essential 8ASD Essentials replaces the Essential Eight
ASD Essentials, released 15 Oct 2026, will replace the Essential Eight. What changes for Melbourne…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.