Menu
Ensure an exclusionary device code flow policy is considered
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-foundations-5-2-3The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-azure-foundations-5.2.3 |
| description | Ensure an exclusionary device code flow policy is considered |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","identity","conditional-access"] |
| cis_id | 5.2.3 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-5.2.2","cis-azure-foundations-5.2.4"] |
| prerequisites | [] |
| severity_boost | {} |
Conditional Access Policies can be used to prevent the Device code authentication flow. Device code flow should be permitted only for users that regularly perform duties that explicitly require the use of Device Code to authenticate, such as utilizing Azure with PowerShell.
Attackers use Device code flow in phishing attacks and, if successful, results in the attacker gaining access tokens and refresh tokens which are scoped to "user_impersonation", which can perform any action the user has permission to perform.
Microsoft Entra ID P1 or P2 is required.
This policy should be tested using the Report-only mode before implementation. Without a full and careful understanding of the accounts and personnel who require Device code authentication flow, implementing this policy can block authentication for users and devices who rely on Device code flow. For users and devices that rely on device code flow authentication, more secure alternatives should be implemented wherever possible.
Microsoft Entra ID.Security.Conditional Access.Policies.Assignments > Users, review the users and groups for the personnel the policy will apply to.Assignments > Target resources, review the cloud apps or actions for the systems the policy will apply to.Conditions > Authentication Flows, review the configuration to ensure Device code flow is selected.Access Controls > Grant - Confirm that Block access is selected.At least one Conditional Access policy should exist that blocks the Device code authentication flow, targeting all users with appropriate exclusions for emergency access accounts.
Part 1 of 2 - Create the policy and enable it in Report-only mode.
Microsoft Entra IDSecurity.Conditional Access.Policies.+ New policy button, then:Assignments, select Users then:
Include, select All users.Exclude, check Users and groups and only select emergency access accounts.Assignments, select Target resources then:
Include, select All cloud apps.Exclude blank unless you have a well defined exception.Conditions > Authentication Flows, set Configure to Yes then:
Device code flow.Done.Access Controls > Grant, select Block Access.Enable policy to Report-only.Create.Allow some time to pass to ensure the sign-in logs capture relevant conditional access events. These events will need to be reviewed to determine if additional considerations are necessary for your organization (e.g. many legitimate use cases of device code authentication are observed).
NOTE: The policy is not yet 'live,' since Report-only is being used to audit the effect of the policy.
Part 2 of 2 - Confirm that the policy is not blocking access that should be granted, then toggle to On.
Sign-in logs.Report-only tab) to ensure:
Policy Name column.Result column for the new policy shows that the policy was Not applied (indicating the device code authentication flow was not blocked).Report-only to On.Save.This policy does not exist by default.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 6.1 Establish an Access Granting Process | x | x | x |
| v7 | 12.4 Deny Communication over Unauthorized Ports | x | x | x |
Level 2 | Manual