3 ms·
Why doesn't this flow require the user to fully login before _requesting_ a device code?
by smw 2y ago
Why doesn't this flow require the user to fully login before _requesting_ a device code?
- gilgoomesh 2y agoThis is affecting setups that are using a device-code-only flow that Microsoft recommend against. > Only allow device code flow where necessary. Microsoft recommends blocking device code flow wherever possible. Where necessary, configure Microsoft Entra ID’s device code flow in your Conditional Access policies. https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/ https://www.microsoft.com/en-us/security/blog/2025/02/13/sto...
- ivewonyoung 2y agoBecause a device code wouldn't be needed if the user could easily login on the device. The user is already fully logged in on the computer where they enter the code.