Live webinarTuesday, 24 November 202610:00 CET
MFA approved. Sender verified.
Account gone.
Device code phishing starts with an email asking the user to enter a short code on Microsoft's real sign-in page. They enter it, approve MFA, and the attacker is now signed in to their account. Nothing looks wrong, because every page was Microsoft's own.
Our incident response team is handling more of these cases. In this 30-minute session we walk through one of them and show the Microsoft 365 and Entra ID settings that block it.
- Duration
- 30 minutes, incl. Q&A
- Language
- English
- Cost
- Free
Your speakers
Maxim D'Hollander
Cyber Strategy Consultant, Secamo
Matthias Van Eyck
Cyber Strategy Consultant, Secamo
Reserve your seat
Free and online. You'll receive the joining link by email, plus the recording afterwards.
Why attend this webinar
An attack that never left Microsoft
Device code phishing has been around for years. The scale is new, and so is the way attackers hide behind Microsoft's own services. We walk you through a recent case where every step the victim saw was genuine.
- 01
A real Microsoft email
Sent through a Microsoft survey service. SPF, DKIM and DMARC all pass.
- 02
A page hosted by Microsoft
A Power Automate flow serves the lure. Microsoft domain, valid certificate.
- 03
The real sign-in page
The user enters a code at microsoft.com/devicelogin and approves MFA, signing in the attacker.
- 04
Long-term access
The attacker registers their own device in Entra ID. A password reset doesn't remove it.
Who should join
Anyone responsible for a Microsoft 365 tenant
- CIOs, IT directors and IT managers
- CISOs and security teams
- Microsoft 365 and Entra ID administrators
- Risk owners who want to understand the business impact
What you'll take away
Three things you can act on the next morning
Built from incidents our response team handled. No sales slides.
How the attack chain works
Step by step through a real case: from the survey email to the attacker's registered device, and why each awareness rule quietly fails.
Has your tenant already been touched?
What to look for in Entra ID: device code sign-ins, unknown devices, new authentication methods, mailbox rules and OAuth consents.
Tenant hardening that stops it
The Conditional Access, device registration and Power Platform settings to review, and how to roll them out without breaking legitimate use.
Your users will keep trusting Microsoft.
Make sure your tenant doesn't trust attackers.
Tuesday, 24 November 2026 · 10:00 CET
Can't make it live? Register anyway and we'll send you the recording.
Reserve your seat
You'll receive the joining link by email, plus the recording afterwards.