Validity of Article on Microsoft Device Code Authentication Threats

Question

Hi Team,

Has anyone evaluated the legitimacy of an article discussing multiple threat actors targeting Microsoft Device Code Authentication? Additionally, what is Microsoft's current stance on this issue? Are there any known fixes or implementations in response to these threats?

The article can be found here: [https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/]. Looking forward to feedback from the community.

Thank you

Answer 1

You can block the device code flow via Conditional access policies: https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows#device-code-flow-policies