# (L1) Ensure the device code sign-in flow is blocked

An enabled Conditional Access policy blocks the device code authentication flow for all users and all cloud apps.

Source: https://maester.dev/docs/tests/CIS.M365.5.2.2.12

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.2.2.12
```

## Overview

An enabled Conditional Access policy blocks the device code authentication flow for all users and all cloud apps.

In device code phishing, an attacker starts a device code sign-in and tricks the victim into entering the code on the genuine Microsoft sign-in page. The victim completes MFA and the attacker receives valid tokens. The flow exists for devices without a keyboard, which most organisations do not use.

Blocking the flow removes the technique. A device filter or an excluded role other than the two directory synchronization roles is reported by this check. User and group exclusions are not evaluated, and application exclusions are not evaluated when the policy targets all apps; document and review such exclusions separately.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to **Entra ID** > **Conditional Access** > [**Policies**](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) and select **New policy**.
3. Under **Users**, include **All users**. Exclude your emergency access accounts.
4. Under **Target resources**, select **All resources (formerly All cloud apps)**.
5. Under **Conditions** > **Authentication flows**, set **Configure** to **Yes** and select **Device code flow**.
6. Under **Grant**, select **Block access**.
7. Set **Enable policy** to **On** (use **Report-only** first to measure the impact) and select **Create**.

#### Related links

* [Microsoft Entra admin center - Conditional Access policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)
* [Block authentication flows with Conditional Access](https://learn.microsoft.com/entra/identity/conditional-access/policy-block-authentication-flows)
* [Conditional Access: authentication flows](https://learn.microsoft.com/entra/identity/conditional-access/concept-authentication-flows)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.12](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.2.2.12 |
| Severity | High |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1528 Steal Application Access Token, T1566 Phishing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.12 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.2.12, nist-800-53-r5:CM-7 |
| PowerShell test | [Test-MtCisBlockDeviceCodeFlow](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.12.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.2.2.12.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.12.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.2.2.12.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.12.md)