If you’ve ever set up a Teams Room, you’ve probably used device code sign-in without giving it a second thought. The screen in the meeting room says something like “go to microsoft.com/devicelogin and enter code XYZ123”. You pull out your phone, sign in, approve the MFA prompt, and the room is ready. Smart TVs do the same thing when you sign in to a streaming app.
It’s a handy way to sign in on a device that doesn’t have a proper keyboard or browser. Unfortunately, the criminals have worked out how to use it against us.
How the attack works
With a normal phishing email, the attacker is trying to steal your password. A device code attack is sneakier than that. The attacker starts a sign-in on their own device, gets a code, and then tricks one of your people into typing that code in.
Here’s the clever (and nasty) part. The sign-in page is the real Microsoft page. The MFA prompt is real too. Your staff member really is signing in to Microsoft. They just don’t realise they’re approving a session that belongs to someone else. And because they’ve approved the MFA themselves, MFA doesn’t stop it.
We’ve seen a big rise in these attacks against Microsoft 365 tenants over the last couple of years, and Microsoft now treats device code sign-in as a higher-risk method. Their advice is to block it anywhere it isn’t needed.
What we’re doing about it
For our KARE clients, we’re restricting device code sign-in in Entra ID using Conditional Access. Honestly, very few people use it in their day-to-day work, so the business benefit is small and the risk keeps growing. Restricting it:
- closes off an attack that’s becoming more and more common
- stops staff from accidentally approving an attacker’s session
- adds protection on top of MFA, rather than relying on MFA alone
- lines you up with Microsoft’s current security guidance.
Will anything break?
It might. Some meeting room systems, shared devices, specialist apps and older platforms still rely on device code sign-in. That’s why we restrict it rather than switching it off everywhere and hoping for the best. If you have a genuine need for it, we’ll look at it with you and set up an exception that only covers what’s required.
The bigger picture
Good security isn’t about adding hoops for the sake of it. It’s about removing risk you don’t need, without getting in the way of people doing their jobs. Device code sign-in is a good example: for most businesses the risk now outweighs the benefit, so we deal with it before it causes a problem, not after.
Not sure how your own Microsoft 365 and Entra ID are set up? Book a free health check and one of our engineers will take a look, or call us on 0800 688 768.