---
title: Tip: block OAuth device code flow with Conditional Access (start in report-only) | ctxsec
url: https://ctxsec.com/items/tip-block-device-code-flow
description: ""
status: "tip"
published: 2026-10-14
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-block-device-code-flow.md)

tip

2026-10-14

### Tip: block OAuth device code flow with Conditional Access (start in report-only)

Device code phishing showed up again in Microsoft's Oct 14 YAM Store / Storm-2990 writeup, and it bypasses password and MFA prompts entirely because the victim authenticates a code for the attacker. Microsoft recommends getting _as close as possible to a unilateral block_. In Entra admin center go to Conditional Access, then New policy. Users: All users (exclude break-glass accounts). Target resources: All resources. Conditions → **Authentication flows** → **Device code flow**. Grant: **Block**. Start in **Report-only**, review sign-in logs for legitimate users (legacy CLI tools, meeting-room devices), carve out documented exceptions, then switch the policy On. The same condition can also block _authentication transfer_ (PC to mobile) if you don't need it.

Sources: [Microsoft Learn: Block authentication flows](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows) · [Microsoft Security Blog (Storm-2990 device code phishing)](https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/)