CodeValve

Keeps Microsoft 365 device-code sign-in shut for everyone, opens it for one named user for ten minutes when they ask, and burns the session if a device-code login lands outside a window.

Problem

Every M365 admin has been told to block device code flow. My bet is that most tenants still have that Conditional Access policy sitting in report-only, because a Teams Room or one engineer's Azure CLI habit breaks the moment it goes live, and nobody wants to be the person who turns it on and then takes the call. So the flow stays open for everyone, all the time, for the sake of three accounts that need it an hour a month. The GhostCode kit that eSentire wrote up in September 2026 registered three attacker devices within 77 seconds of the victim typing a code and walked away with a Primary Refresh Token good for 14 days.

Target user

The MSP technician or solo IT admin who runs a 20 to 300 seat Business Premium tenant and owns the Conditional Access policies. Their job is to close the device-code hole without breaking the two or three things that legitimately use it. Today they either block it and field the complaints, or keep a permanent exclusion group that quietly grows and never shrinks. CIPP can push the block policy to every tenant in bulk, and Huntress will tell them after the token was stolen. Nothing in between hands out the flow in small timed doses.

MVP scope

• Onboards a tenant through an Entra app registration with the minimum Graph scopes, then creates (or adopts) the block-device-code Conditional Access policy with an exclusion group the tool owns, and reports whether the existing policy is still report-only.
• Timed windows: a user or admin requests device-code access for a named account from a Teams message, Slack command, or CLI; the tool adds that account to the exclusion group, holds the window for the requested minutes (default 10, cap 60), then removes it. Every window records who asked, who approved, and why.
• Standing allowances for named service accounts (Teams Rooms, a build runner) with an expiry date and a monthly re-attestation ping to the admin who created them.
• Tripwire: polls the Graph sign-in log for sign-ins whose authentication protocol is device code, matches each against open windows, and for any miss revokes that user's sign-in sessions, disables every device registered to that user in the previous 15 minutes, and alerts with the source IP and ASN.
• Seven-day observe mode on first install that lists who actually uses device code flow and what the tripwire would have fired on, so the admin can flip the policy from report-only to on with evidence in hand.
• Multi-tenant console for MSPs: one screen showing policy state, open windows, standing allowances, and tripwire hits across every client tenant.

Monetization

Subscription per tenant. Around $19/mo for a single tenant with unlimited windows, and an MSP tier near $9/mo per tenant at ten or more with the multi-tenant console and a white-label alert sender. Graph calls are free and the polling load is tiny, so the cost of serving a tenant is close to zero and the price is really for the on-call peace of mind.

Why now

Device-code phishing stopped being a niche trick in 2026. Microsoft counted 10 to 15 new campaigns a day in April 2026, Huntress tracked the Railway and BL Networks waves through July across hundreds of tenants and more than a hundred MSPs, and eSentire published GhostCode on 18 September 2026 with the 77-second device-registration chain. Microsoft's own answer is the Conditional Access block, which it documents and ships as a managed policy, but that policy is all-or-nothing per user and needs Entra ID P1. Passkeys became the default Entra authentication method on 1 September 2026, which makes device-code flow the obvious remaining way to walk around phishing-resistant MFA: the victim does a perfectly legitimate sign-in, just for the wrong device.

Risks & open questions

• Demand: admins who already run CIPP may add a scheduled exclusion-group script themselves rather than pay for a product. The buyer has to be the one who wants the request-and-approve audit trail rather than the toggle alone.
• Microsoft could ship timed exclusions or per-request device-code approval inside Entra and make this a settings page. I have no signal that they will, but the feature is small enough that they could.
• Timing: Graph sign-in logs land minutes late and Conditional Access changes take time to propagate. The tripwire catches the 14-day token, not the 77-second registration burst. The product has to say that plainly or it gets blamed for the first incident it did not prevent.
• Build: the tool needs an app registration that can edit Conditional Access policies, group membership, devices, and sessions. That registration is itself a prize target, so the solo build has to include key rotation, scoped-per-tenant credentials, and a kill switch before anyone should install it.
• Licensing: Business Basic and Standard tenants have no Conditional Access and no Graph access to sign-in logs, so the smallest shops, who get phished the most, cannot use it at all.

Next step

Build the window-and-tripwire loop against one test tenant, then put it in front of five MSPs that use CIPP and ask whether they would pay per tenant to replace the exclusion group they already maintain by hand.

Sources

• https://www.csoonline.com/article/4223898/ghostcode-attackers-abuse-device-codes-to-take-over-microsoft-365-accounts-2.html (18 September 2026): eSentire's GhostCode write-up; three devices registered within 77 seconds of authentication, Primary Refresh Token with a 14-day lifespan, mitigation via Conditional Access and device-registration monitoring.
• https://www.huntress.com/blog/device-code-phishing-evolving-threats (31 July 2026): Railway and BL Networks campaigns, 268+ organisations and 100+ MSPs hit, detection by ASN clustering, and the advice to restrict device-code authentication and revoke sessions quickly.
• https://www.boerse-express.com/news/articles/device-code-phishing-50-aller-sicherheitsvorfaelle-im-q2-2026-934339 (1 August 2026): roundup of Push Security, Cisco Talos, Microsoft, Barracuda and Huntress figures, including 10 to 15 new device-code campaigns per day in April 2026 and more than 25 active kits.
• https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows (updated 7 April 2026): Microsoft's recommended block-device-code policy, report-only rollout, and the exclusion-list pattern this tool automates.
• https://learn.microsoft.com/en-us/graph/api/resources/signin: the Graph sign-in resource the tripwire polls; sign-in logs through Graph require an Entra ID P1 or P2 licence.
• https://cybersecuritynews.com/microsoft-make-passkeys-default-in-entra-id/ (15 August 2026): passkeys default in Entra ID from 1 September 2026 and SMS/voice retired by 1 February 2027.