MT.1052: At least one Conditional Access policy is targeting the Device Code authentication flow.

ID	MT.1052
Severity	High
Suite	Mito
Product	Entra ID
Feature	Conditional Access
Security area	Authentication
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Framework controls	nist-800-53-r5:CM-7 Least Functionality nist-800-53-r5:IA-2 Identification and Authentication (Organizational Users)
MITRE ATT&CK	T1078.004, T1528, T1566
Reads from	Microsoft Graph

What this checks and how to fix it

Checks if at least one policy is targeting the Device Code condition.

Organizations should block or limit device code flow because it can be exploited in phishing attacks, such as those conducted by the Storm-2372 group. Attackers leverage this authentication method to trick users into entering device codes on malicious websites, granting unauthorized access to accounts. Blocking or limiting this flow helps prevent exploitation by minimizing attack vectors, improving overall security posture, and safeguarding against compromised credentials through phishing techniques.

How to fix

Configure a Conditional Access policy to block the Device Code authentication flow and limit access to only trusted users and devices or to specific named locations.

Learn more

• Block authentication flows with Conditional Access policy
• Microsoft Threat Intelligence | Storm-2372 conducts device code phishing campaign
• Jeffrey Appel | How to protect against Device Code Flow abuse (Storm-2372 attacks) and block the authentication flow

---

Mito check. Author: BakkerJan; contributors: merill, thomas-s-schmidt. Open-source licences.