MT.1052 - At least one Conditional Access policy is targeting the Device Code authentication flow.
Overview
Checks if at least one policy is targeting the Device Code condition.
Organizations should block or limit device code flow because it can be exploited in phishing attacks, such as those conducted by the Storm-2372 group. Attackers leverage this authentication method to trick users into entering device codes on malicious websites, granting unauthorized access to accounts. Blocking or limiting this flow helps prevent exploitation by minimizing attack vectors, improving overall security posture, and safeguarding against compromised credentials through phishing techniques.
How to fix
Configure a Conditional Access policy to block the Device Code authentication flow and limit access to only trusted users and devices or to specific named locations.
Learn more
- Block authentication flows with Conditional Access policy
- Microsoft Threat Intelligence | Storm-2372 conducts device code phishing campaign
- Jeffrey Appel | How to protect against Device Code Flow abuse (Storm-2372 attacks) and block the authentication flow
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1052 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1528 Steal Application Access Token, T1566 Phishing |
| Supports controls | nist-800-53-r5:CM-7, nist-800-53-r5:IA-2 |
| PowerShell test | Test-MtCaDeviceCodeFlow |
| Services | Graph |
Source
- Test:
tests/maester/entra/Test.MT.1052.ps1 - Documentation:
tests/maester/entra/Test.MT.1052.md