Microsoft-managed Conditional Access policies
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 8a730df · +3 −1 lines · also on GitHub
⋯ 3 unchanged lines
44
ms.service: entra-id
55
ms.subservice: conditional-access
66
ms.topic: concept-article
7
−ms.date: 05/20/2026
7
+ms.date: 05/28/2026
88
ms.reviewer: swethar
99
ms.custom: sfi-image-nochange
1010
ai-usage: ai-assisted
⋯ 86 unchanged lines
9797
This policy blocks device code flow, where a user initiates authentication on one device, completes on another, and their token is sent back to the original device. This type of authentication is common where users can't enter their credentials, like smart TVs, Microsoft Teams Room devices, IoT devices, or printers.
9898
9999
Device code flow is rarely used by customers, but is frequently used by attackers. Enabling this Microsoft-managed policy for your organization helps remove this attack vector.
100
+
101
+If your organization uses Microsoft Teams devices that require device code flow, follow the guidance in [Restrict device code flow for Microsoft Teams devices with Conditional Access](policy-teams-devices-device-code-flow.md) to scope exceptions correctly while continuing to block device code flow for other accounts.
100102
101103
### Multifactor authentication for admins accessing Microsoft Admin portals
102104
⋯ 174 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:29 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.