The 'enter this code' trick: how device-code phishing gets past MFA

Most people have learned to check the address bar before they sign in. Device-code phishing gets around that, because the sign-in page is genuine.

How it works

Some devices, such as smart TVs and conference-room screens, can’t show a full sign-in page. Microsoft handles this with a “device code” flow: the device shows a short code, you open a Microsoft page on your phone or laptop, type the code and sign in. The device is then signed in as you.

Attackers abuse that convenience:

1. They start a device-code sign-in themselves and get a code.
2. They send you a lure, such as “Enter this code to view the shared document.”
3. You go to the real Microsoft page, enter the code and approve MFA.
4. The attacker’s session is now signed in as you.

You did everything “right”: real website, real MFA. You just approved the wrong device.

Signs to watch for

• A document, voicemail or meeting invite that asks you to enter a code on a Microsoft page.
• A sign-in prompt you did not start yourself.
• Any message that rushes you: “This code expires in 15 minutes.”

If you didn’t start the sign-in, don’t enter the code.

How to shut it down (for IT teams)

• Block the device-code flow with Conditional Access for everyone who doesn’t need it. Entra ID lets you target authentication flows directly, and most users never need device-code sign-in.
• Allow it only where needed, such as specific shared devices or service accounts, and monitor those.
• Watch for new device registrations and sign-ins using the device-code flow, especially right after a suspicious email.
• If it happens, act fast: revoke the user’s sessions, remove any devices registered by the attacker and check for new inbox rules or app consents.

MFA is still essential, but it isn’t the whole defence. Closing sign-in methods nobody needs is one of the quickest wins in Microsoft 365.