Block device code flow

Device code flow lets an attacker phish a working access token without a fake login page: the victim types a real code into a real Microsoft sign-in page, completes MFA themselves, and the resulting token goes to the attacker. Almost no organisation needs the flow, and Conditional Access can switch it off.

A scan reports where your tenant stands on this check — pass, fail with a step-by-step fix, or not applicable if your licensing doesn’t include the feature. When Tenant Strike can’t read a setting with read-only access, it says unverified and gives you a one-command way to confirm it yourself — it never guesses.