Device code phishing showed up again in Microsoft's Oct 14 YAM Store / Storm-2990 writeup, and it bypasses password and MFA prompts entirely because the victim authenticates a code for the attacker. Microsoft recommends getting as close as possible to a unilateral block. In Entra admin center go to Conditional Access, then New policy. Users: All users (exclude break-glass accounts). Target resources: All resources. Conditions → Authentication flows → Device code flow. Grant: Block. Start in Report-only, review sign-in logs for legitimate users (legacy CLI tools, meeting-room devices), carve out documented exceptions, then switch the policy On. The same condition can also block authentication transfer (PC to mobile) if you don't need it.