Entra security defaults
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit cdac7c8 · +8 −0 lines · also on GitHub
⋯ 26 unchanged lines
2727
- [Requiring administrators to do multifactor authentication](#require-administrators-to-do-multifactor-authentication)
2828
- [Requiring users to do multifactor authentication when necessary](#require-users-to-do-multifactor-authentication-when-necessary)
2929
- [Blocking legacy authentication protocols](#block-legacy-authentication-protocols)
30
+- [Blocking device code flow](#block-device-code-flow)
3031
- [Protecting privileged activities like access to the Azure portal](#protect-privileged-activities-like-access-to-the-azure-portal)
3132
3233
## Who's it for?
⋯ 92 unchanged lines
125126
> Before you enable security defaults, make sure your administrators aren't using older authentication protocols. For more information, see [How to move away from legacy authentication](~/identity/conditional-access/policy-block-legacy-authentication.md).
126127
127128
- [How to set up a multifunction device or application to send email using Microsoft 365](/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365)
129
+
130
+### Block device code flow
131
+
132
+Device code flow is an authentication flow that lets users sign in to devices or applications that have limited input capabilities, such as devices without a browser or keyboard. Attackers can abuse device code flow in phishing attacks by tricking users into entering a code on another device.
133
+
134
+After security defaults are enabled in your tenant, authentication requests that use device code flow are blocked. Applications or devices that depend on device code flow won't be able to complete sign-in while security defaults are enabled.
135
+If your organization needs granular control and exceptions, you should consider [Conditional Access](/entra/identity/conditional-access/concept-conditional-access-policy-common).
128136
129137
### Protect privileged activities like access to the Azure portal
130138
⋯ 82 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.