Risk Register — Device Code Authentication Abuse
A practical risk register template covering OAuth 2.0 Device Code phishing exposure in Microsoft 365 environments. Based on active threat intelligence from Storm-2372, TA2723, and the EvilTokens PhaaS ecosystem. See the companion article: Device Code Phishing — The Attack That Makes MFA Irrelevant
| Low Impact | Medium Impact | High Impact | Critical Impact | |
|---|---|---|---|---|
| High Likelihood | Medium | High | Critical | Critical |
| Medium Likelihood | Low | Medium | High | Critical |
| Low Likelihood | Low | Low | Medium | High |
| Very Low Likelihood | Low | Low | Low | Medium |
Attacker initiates OAuth 2.0 Device Authorization Flow against the tenant IdP, socially engineers a user into entering the resulting user_code, and collects a valid Bearer + refresh token without stealing credentials or bypassing MFA.
High — technique is commodity-level, available via PhaaS kits, actively targeting M365 tenants globally as of Q1 2026.
Critical — full account access, persistent via refresh token, survives password resets without explicit revocation.
MFA enforced, Conditional Access policies in place (general). Device Code Flow not explicitly restricted.
Following a successful device code phishing attack, the attacker holds a long-lived refresh token providing persistent access. Standard remediation (password reset, MFA reset) does not invalidate refresh tokens without explicit revocation.
Medium — contingent on successful IAM-001 exploitation. Dwell time risk is high once access is obtained.
High — persistent access survives common remediation steps, extending attacker dwell time significantly.
Account monitoring, periodic access reviews. Token revocation procedure not formally documented in IR runbook.
revokeSignInSessions API.Attackers target privileged accounts using first-party Microsoft Client IDs (e.g., Microsoft Authentication Broker). These apps are pre-trusted in every Entra tenant and suppress the OAuth consent prompt, removing a key visual indicator for the victim.
Medium — requires targeted reconnaissance but nation-state and financially motivated actors both demonstrate this TTPs.
Critical — privileged account compromise enables lateral movement, data exfiltration, and persistent backdoor creation.
PIM enforced, MFA on admin accounts, limited standing admin access. Device Code Flow not scoped by role.
SIEM rules are tuned for credential-based attacks. OAuth token abuse — Device Code Flow, token replay, refresh token persistence — may not generate alerts under current detection logic.
High — detection gap is common across most organizations. Credential-attack tuning is well understood; authorization-layer abuse is not.
High — undetected compromise enables extended dwell time and secondary objectives before discovery.
SIEM deployed, general sign-in alerting configured. No specific rules for deviceCode auth method or OAuth abuse patterns.
deviceCode authentication method in Entra ID sign-in logs.deviceCode auth events for privileged accounts — treat as critical priority, page on-call immediately.| Function | Subcategory | Relevance |
|---|---|---|
| GOVERN | GV.RM-01, GV.RM-02 | Risk tolerance and context established for identity and authorization attack vectors |
| IDENTIFY | ID.RA-01, ID.RA-04 | Threat intelligence on device code phishing actors (Storm-2372, TA2723, EvilTokens); risk to privileged assets identified |
| PROTECT | PR.AA-02, PR.AA-05 | Conditional Access blocking Device Code Flow; privileged account access controls; token lifecycle management |
| DETECT | DE.CM-01, DE.CM-09, DE.AE-02 | SIEM rules for deviceCode auth events; refresh token anomaly detection; OAuth abuse pattern alerting |
| RESPOND | RS.MI-02, RS.AN-03, RS.CO-02 | Token revocation runbook; IR analysis for OAuth abuse; communications for privileged account compromise events |