---
title: Entra ID device code phishing
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Entra ID device code phishing
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Entra ID device code phishing
Classification:attackTactic:[TA0006-credential-access](https://attack.mitre.org/tactics/TA0006)Technique:[T1528-steal-application-access-token](https://attack.mitre.org/techniques/T1528) 
## Goal{% #goal %}

Detects Entra ID device code phishing where a pending device code sign-in is followed by a successful authentication through `Microsoft Authentication Broker` or `OfficeHome`.

## Strategy{% #strategy %}

This rule monitors Entra ID sign-in activity for the device code authentication sequence associated with credential phishing. It correlates a sign-in with `@ocsf.status_code` `50199`, which indicates a device code is awaiting user approval, with a subsequent successful sign-in where `@properties.authenticationProtocol` is `deviceCode` for the same user.

Device code phishing abuses the OAuth device authorization grant: an attacker starts the flow and obtains a user code, then tricks the victim into approving the sign-in at `microsoft.com/devicelogin`. The victim's completed authentication issues tokens to the attacker's session. Commonly abused first-party clients in this technique include `Microsoft Authentication Broker` and `OfficeHome`.

## Triage & Response{% #triage--response %}

- Contact `{{@ocsf.actor.user.email_addr}}` to determine whether they intentionally entered a device code at `microsoft.com/devicelogin` during the alert timeframe.
- Review the sign-in details for the pending and successful events, including `{{@network.client.ip}}`, geographic location, and client application name, and compare them to the user's normal authentication patterns.
- Identify whether the user reported a phishing page, unsolicited login prompt, or MFA approval they did not initiate around the time of the alert.
- Examine sign-in and audit activity for `{{@ocsf.actor.user.email_addr}}` immediately after the successful device code authentication for mailbox access, file downloads, application consent, or privilege changes.
- Check for additional device code sign-ins across other users from the same `{{@network.client.ip}}` or similar client details to assess campaign scope.
- Revoke active sessions, remove any registered devices and reset credentials for `{{@ocsf.actor.user.email_addr}}` if the user did not authorize the device code authentication.