device code flow

Device Code Flow (DCF) is an authentication method used by devices without a full web browser, such as Microsoft Teams-certified Android devices including Teams Rooms, Phones, Panels, and Displays. Recent Microsoft security updates have introduced Conditional Access policies in Microsoft Entra ID that block DCF authentication, causing lockouts for some enterprise devices. Microsoft has also deployed new managed policies to curb risks associated with DCF, as threat actors, including Russian groups like Cozy Bear, have exploited device code authentication in spear-phishing attacks targeting Microsoft 365 accounts. These developments highlight the tension between security mandates and device usability in enterprise IT environments.