Edit

Share via

Block authentication flows with Conditional Access policy

The following steps help you create Conditional Access policies to restrict how device code flow and authentication transfer are used within your organization.

Device code flow policies

We recommend organizations get as close as possible to a unilateral block on device code flow. Consider creating a policy to audit the existing use of device code flow and determine if it's still necessary. Only allow device code flow in well documented and secured use cases, like legacy tooling that can't be updated.

For organizations that don't use device code flow, block it with the following Conditional Access policy:

  1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
  2. Browse to Entra ID > Conditional Access > Policies.
  3. Select New policy.
  4. Under Assignments, select Users or workload identities.
    1. Under Include, select the users you want to be in-scope for the policy (all users recommended).
    2. Under Exclude:
      1. Select Users and groups and choose your organization's emergency access or break-glass accounts and any other necessary users. Audit this exclusion list regularly.
  5. Under Target resources > Resources (formerly cloud apps) > Include, select the apps you want to be in-scope for the policy (All resources (formerly 'All cloud apps') recommended).
  6. Under Conditions > Authentication Flows, set Configure to Yes.
    1. Select Device code flow.
    2. Select Done.
  7. Under Access controls > Grant, select Block access.
    1. Select Select.
  8. Confirm your settings and set Enable policy to Report-only.
  9. Select Create to enable your policy.

After confirming your settings using policy impact or report-only mode, move the Enable policy toggle from Report-only to On.

Authentication transfer policies

Use the Authentication flows condition in Conditional Access to manage the feature. Block authentication transfer if you don't want users to transfer authentication from their PC to a mobile device. For example, block authentication transfer if you don't allow Outlook to be used on personal devices by certain groups. Use the following Conditional Access policy to block authentication transfer:

  1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
  2. Browse to Entra ID > Conditional Access > Policies.
  3. Select New policy.
  4. Under Assignments, select Users or workload identities.
    1. Under Include, select All users or user groups you want to block for authentication transfer.
    2. Under Exclude:
      1. Select Users and groups and choose your organization's emergency access or break-glass accounts and any other necessary users. Audit this exclusion list regularly.
  5. Under Target resources > Resources (formerly cloud apps) > Include, select All resources (formerly 'All cloud apps') or apps you want to block for authentication transfer.
  6. Under Conditions > Authentication Flows, set Configure to Yes
    1. Select Authentication transfer.
    2. Select Done.
  7. Under Access controls > Grant, select Block access.
    1. Select Select.
  8. Confirm your settings and set Enable policy to Enabled.
  9. Select Create to enable your policy.

Related content

  • Last updated on