Detections
Analytics

MS.AAD.3.9v1 - Device code authentication SHOULD be blocked.

Information

The device code authentication flow has been abused to compromise user accounts via phishing. Since most organizations using M365 don't need device code authentication, blocking it mitigates the risk.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

1. Create a Conditional Access policy to block device code flow

 Users > Include > All users

 Target resources > Include > All resources (formerly 'All cloud apps')

 Conditions > Authentication Flows > Configure > Yes > Select Device code flow

 Access controls > Grant > Block Access

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7

Plugin: microsoft_azure

Control ID: f7d7042cda6666cf3f8840f4fc22e3a5051fd8074016de663a55a5b99757a0e1