Device Code Flow Blocked

<# .SYNOPSIS Device Code Flow Blocked .DESCRIPTION Ensures device code flow authentication is blocked via Conditional Access. Device code flow can be abused for phishing - should be restricted. .NOTES Filename: device-code-flow-blocked.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\device-code-flow-blocked.ps1 -Monitoring Check if device code flow is blocked #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring, [Parameter(Mandatory = $false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Device Code Flow Blocked" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { <# .SYNOPSIS Checks authorization policy and CA policies for device code flow #> function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Device Code Flow Blocked .DESCRIPTION Ensures device code flow authentication is blocked via Conditional Access. Device code flow can be abused for phishing - should be restricted. .NOTES Filename: device-code-flow-blocked.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\device-code-flow-blocked.ps1 -Monitoring Check if device code flow is blocked #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Device Code Flow Blocked" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { <# .SYNOPSIS Checks authorization policy and CA policies for device code flow #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking authorization policy..." -ForegroundColor Gray $authPolicy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/beta/policies/authorizationPolicy" # Note: There's no direct property for device code flow in the API # It's controlled via Conditional Access policies targeting deviceCodeFlow client app Write-Host "Checking Conditional Access policies for device code flow..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false deviceCodeFlowPolicies = 0 } foreach ($policy in $policies.value) { # Look for policies that target specific client types or apps if ($policy.conditions.clientAppTypes -contains 'other' -or $policy.displayName -match 'device code') { if ($policy.state -eq 'enabled' -and $policy.grantControls.builtInControls -contains 'block') { $result.deviceCodeFlowPolicies++ $result.isCompliant = $true Write-Host " [OK] BLOCKING POLICY: $($policy.displayName)" -ForegroundColor Green } } } Write-Host "`n Device code flow blocking policies: $($result.deviceCodeFlowPolicies)" -ForegroundColor $( if ($result.deviceCodeFlowPolicies -gt 0) { 'Green' } else { 'Yellow' } ) Write-Host "`n What is device code flow?" -ForegroundColor Cyan Write-Host " • Used for devices without browsers (IoT, CLI tools)" -ForegroundColor Gray Write-Host " • User enters code on another device" -ForegroundColor Gray Write-Host " • Can be abused for phishing attacks" -ForegroundColor Red Write-Host " • Should be blocked unless specifically needed" -ForegroundColor Yellow if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ NO DEVICE CODE FLOW BLOCKING FOUND" -ForegroundColor Yellow Write-Host "Consider blocking this authentication method" -ForegroundColor Cyan exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Guidance for blocking device code flow #> try { Write-Host "⚠️ Device code flow should be blocked via Conditional Access" -ForegroundColor Yellow Write-Host "`nSteps to block device code flow:" -ForegroundColor Cyan Write-Host "`n1. Create Conditional Access policy:" -ForegroundColor Green Write-Host " Azure Portal > Azure AD > Security > Conditional Access" -ForegroundColor Gray Write-Host " • Name: Block Device Code Flow" -ForegroundColor Gray Write-Host " • Users: All users" -ForegroundColor Gray Write-Host " • Cloud apps: All apps" -ForegroundColor Gray Write-Host " • Conditions > Client apps: Other clients" -ForegroundColor Gray Write-Host " • Grant: Block access" -ForegroundColor Gray Write-Host "`n2. Alternative - Allow for specific apps only:" -ForegroundColor Green Write-Host " If some apps require device code flow:" -ForegroundColor Gray Write-Host " • Exclude those specific apps from the block policy" -ForegroundColor Gray Write-Host " • Document business justification" -ForegroundColor Gray Write-Host "`n📝 Security Note:" -ForegroundColor Cyan Write-Host " Device code flow phishing: Attacker shows code, " -ForegroundColor Gray Write-Host " victim enters it thinking it's legitimate" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check device code flow policies" -ForegroundColor Gray Write-Host " -Remediation Show configuration guidance" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking authorization policy..." -ForegroundColor Gray $authPolicy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/beta/policies/authorizationPolicy" # Note: There's no direct property for device code flow in the API # It's controlled via Conditional Access policies targeting deviceCodeFlow client app Write-Host "Checking Conditional Access policies for device code flow..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false deviceCodeFlowPolicies = 0 } foreach ($policy in $policies.value) { # Look for policies that target specific client types or apps if ($policy.conditions.clientAppTypes -contains 'other' -or $policy.displayName -match 'device code') { if ($policy.state -eq 'enabled' -and $policy.grantControls.builtInControls -contains 'block') { $result.deviceCodeFlowPolicies++ $result.isCompliant = $true Write-Host " [OK] BLOCKING POLICY: $($policy.displayName)" -ForegroundColor Green } } } Write-Host "`n Device code flow blocking policies: $($result.deviceCodeFlowPolicies)" -ForegroundColor $( if ($result.deviceCodeFlowPolicies -gt 0) { 'Green' } else { 'Yellow' } ) Write-Host "`n What is device code flow?" -ForegroundColor Cyan Write-Host " • Used for devices without browsers (IoT, CLI tools)" -ForegroundColor Gray Write-Host " • User enters code on another device" -ForegroundColor Gray Write-Host " • Can be abused for phishing attacks" -ForegroundColor Red Write-Host " • Should be blocked unless specifically needed" -ForegroundColor Yellow if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ NO DEVICE CODE FLOW BLOCKING FOUND" -ForegroundColor Yellow Write-Host "Consider blocking this authentication method" -ForegroundColor Cyan exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Guidance for blocking device code flow #> function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Device Code Flow Blocked .DESCRIPTION Ensures device code flow authentication is blocked via Conditional Access. Device code flow can be abused for phishing - should be restricted. .NOTES Filename: device-code-flow-blocked.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\device-code-flow-blocked.ps1 -Monitoring Check if device code flow is blocked #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Device Code Flow Blocked" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { <# .SYNOPSIS Checks authorization policy and CA policies for device code flow #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking authorization policy..." -ForegroundColor Gray $authPolicy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/beta/policies/authorizationPolicy" # Note: There's no direct property for device code flow in the API # It's controlled via Conditional Access policies targeting deviceCodeFlow client app Write-Host "Checking Conditional Access policies for device code flow..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false deviceCodeFlowPolicies = 0 } foreach ($policy in $policies.value) { # Look for policies that target specific client types or apps if ($policy.conditions.clientAppTypes -contains 'other' -or $policy.displayName -match 'device code') { if ($policy.state -eq 'enabled' -and $policy.grantControls.builtInControls -contains 'block') { $result.deviceCodeFlowPolicies++ $result.isCompliant = $true Write-Host " [OK] BLOCKING POLICY: $($policy.displayName)" -ForegroundColor Green } } } Write-Host "`n Device code flow blocking policies: $($result.deviceCodeFlowPolicies)" -ForegroundColor $( if ($result.deviceCodeFlowPolicies -gt 0) { 'Green' } else { 'Yellow' } ) Write-Host "`n What is device code flow?" -ForegroundColor Cyan Write-Host " • Used for devices without browsers (IoT, CLI tools)" -ForegroundColor Gray Write-Host " • User enters code on another device" -ForegroundColor Gray Write-Host " • Can be abused for phishing attacks" -ForegroundColor Red Write-Host " • Should be blocked unless specifically needed" -ForegroundColor Yellow if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ NO DEVICE CODE FLOW BLOCKING FOUND" -ForegroundColor Yellow Write-Host "Consider blocking this authentication method" -ForegroundColor Cyan exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Guidance for blocking device code flow #> try { Write-Host "⚠️ Device code flow should be blocked via Conditional Access" -ForegroundColor Yellow Write-Host "`nSteps to block device code flow:" -ForegroundColor Cyan Write-Host "`n1. Create Conditional Access policy:" -ForegroundColor Green Write-Host " Azure Portal > Azure AD > Security > Conditional Access" -ForegroundColor Gray Write-Host " • Name: Block Device Code Flow" -ForegroundColor Gray Write-Host " • Users: All users" -ForegroundColor Gray Write-Host " • Cloud apps: All apps" -ForegroundColor Gray Write-Host " • Conditions > Client apps: Other clients" -ForegroundColor Gray Write-Host " • Grant: Block access" -ForegroundColor Gray Write-Host "`n2. Alternative - Allow for specific apps only:" -ForegroundColor Green Write-Host " If some apps require device code flow:" -ForegroundColor Gray Write-Host " • Exclude those specific apps from the block policy" -ForegroundColor Gray Write-Host " • Document business justification" -ForegroundColor Gray Write-Host "`n📝 Security Note:" -ForegroundColor Cyan Write-Host " Device code flow phishing: Attacker shows code, " -ForegroundColor Gray Write-Host " victim enters it thinking it's legitimate" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check device code flow policies" -ForegroundColor Gray Write-Host " -Remediation Show configuration guidance" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "⚠️ Device code flow should be blocked via Conditional Access" -ForegroundColor Yellow Write-Host "`nSteps to block device code flow:" -ForegroundColor Cyan Write-Host "`n1. Create Conditional Access policy:" -ForegroundColor Green Write-Host " Azure Portal > Azure AD > Security > Conditional Access" -ForegroundColor Gray Write-Host " • Name: Block Device Code Flow" -ForegroundColor Gray Write-Host " • Users: All users" -ForegroundColor Gray Write-Host " • Cloud apps: All apps" -ForegroundColor Gray Write-Host " • Conditions > Client apps: Other clients" -ForegroundColor Gray Write-Host " • Grant: Block access" -ForegroundColor Gray Write-Host "`n2. Alternative - Allow for specific apps only:" -ForegroundColor Green Write-Host " If some apps require device code flow:" -ForegroundColor Gray Write-Host " • Exclude those specific apps from the block policy" -ForegroundColor Gray Write-Host " • Document business justification" -ForegroundColor Gray Write-Host "`n📝 Security Note:" -ForegroundColor Cyan Write-Host " Device code flow phishing: Attacker shows code," -ForegroundColor Gray Write-Host " victim enters it thinking it's legitimate" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Device Code Flow Blocked .DESCRIPTION Ensures device code flow authentication is blocked via Conditional Access. Device code flow can be abused for phishing - should be restricted. .NOTES Filename: device-code-flow-blocked.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\device-code-flow-blocked.ps1 -Monitoring Check if device code flow is blocked #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring, [Parameter(Mandatory = $false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Device Code Flow Blocked" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { <# .SYNOPSIS Checks authorization policy and CA policies for device code flow #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking authorization policy..." -ForegroundColor Gray $authPolicy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/beta/policies/authorizationPolicy" # Note: There's no direct property for device code flow in the API # It's controlled via Conditional Access policies targeting deviceCodeFlow client app Write-Host "Checking Conditional Access policies for device code flow..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false deviceCodeFlowPolicies = 0 } foreach ($policy in $policies.value) { # Look for policies that target specific client types or apps if ($policy.conditions.clientAppTypes -contains 'other' -or $policy.displayName -match 'device code') { if ($policy.state -eq 'enabled' -and $policy.grantControls.builtInControls -contains 'block') { $result.deviceCodeFlowPolicies++ $result.isCompliant = $true Write-Host " [OK] BLOCKING POLICY: $($policy.displayName)" -ForegroundColor Green } } } Write-Host "`n Device code flow blocking policies: $($result.deviceCodeFlowPolicies)" -ForegroundColor $( if ($result.deviceCodeFlowPolicies -gt 0) { 'Green' } else { 'Yellow' } ) Write-Host "`n What is device code flow?" -ForegroundColor Cyan Write-Host " • Used for devices without browsers (IoT, CLI tools)" -ForegroundColor Gray Write-Host " • User enters code on another device" -ForegroundColor Gray Write-Host " • Can be abused for phishing attacks" -ForegroundColor Red Write-Host " • Should be blocked unless specifically needed" -ForegroundColor Yellow if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ NO DEVICE CODE FLOW BLOCKING FOUND" -ForegroundColor Yellow Write-Host "Consider blocking this authentication method" -ForegroundColor Cyan exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Guidance for blocking device code flow #> try { Write-Host "⚠️ Device code flow should be blocked via Conditional Access" -ForegroundColor Yellow Write-Host "`nSteps to block device code flow:" -ForegroundColor Cyan Write-Host "`n1. Create Conditional Access policy:" -ForegroundColor Green Write-Host " Azure Portal > Azure AD > Security > Conditional Access" -ForegroundColor Gray Write-Host " • Name: Block Device Code Flow" -ForegroundColor Gray Write-Host " • Users: All users" -ForegroundColor Gray Write-Host " • Cloud apps: All apps" -ForegroundColor Gray Write-Host " • Conditions > Client apps: Other clients" -ForegroundColor Gray Write-Host " • Grant: Block access" -ForegroundColor Gray Write-Host "`n2. Alternative - Allow for specific apps only:" -ForegroundColor Green Write-Host " If some apps require device code flow:" -ForegroundColor Gray Write-Host " • Exclude those specific apps from the block policy" -ForegroundColor Gray Write-Host " • Document business justification" -ForegroundColor Gray Write-Host "`n📝 Security Note:" -ForegroundColor Cyan Write-Host " Device code flow phishing: Attacker shows code," -ForegroundColor Gray Write-Host " victim enters it thinking it's legitimate" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check device code flow policies" -ForegroundColor Gray Write-Host " -Remediation Show configuration guidance" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check device code flow policies" -ForegroundColor Gray Write-Host " -Remediation Show configuration guidance" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }