To best support the mitigation of security threats, data flow diagrams should include all risk assessments (corporate governance, external vendors and ancillary systems, and key business processes), ...

Additionally, if you suspect device code phishing, revoke the user's refresh tokens and also consider setting a conditional access policy to force re-authentication for users.

It exploits “device code flow,” a form of authentication formalized in the industry-wide OAuth standard. Authentication through device code flow is designed for logging printers, smart TVs ...

The campaign uses a technique called "device code phishing" that attempts to trick marks into providing all the details needed to give crooks access to the victim's accounts – usernames, passwords, ...