FactorAI
Demo ModeExit demoStart free
Ready
You
What is the current guidance on device-code phishing and do we need a policy?
Assistant

Latest guidance on the OAuth device-code phishing technique:

  • Attackers trick users into entering a code on the real login page, which grants them a token.
  • Recommended control: block the device-code flow with a Conditional Access policy for everyone except the kiosk group.

We have 3 kiosk accounts, so I drafted the policy exception list for review.

You
Show me the exception list.
Assistant

Exception list for review:

  • kiosk-lobby-01
  • kiosk-warehouse-02
  • kiosk-training-03

All three are shared devices with no mailbox attached.

You
Should we roll this out in report-only mode first?
Assistant

Report-only mode for two weeks is safest. It logs which sign-ins would have been blocked without affecting anyone, and we can confirm only the three kiosks use device code.

You
Give me a rollout plan with dates.
Assistant

Rollout plan:

  1. Oct 28: enable policy in report-only mode.
  2. Nov 11: review sign-in logs for unexpected device-code use.
  3. Nov 12: switch to enforced with the kiosk exception.