Chris Brumm's Blog

Device Code Phishing: Prevention, Detection and Response

How device code phishing works, what Microsoft detects by now, and what you still have to build yourself.

The trigger for this post is the session “The 2026 state of advanced identity attacks” that I presented together with Eric Woodruff at the Workplace Ninja Summit 2026 in September. The idea behind it: whenever one of these attacks makes the news, the same questions come up (are we vulnerable? has Microsoft fixed this? how likely is it really?), and a few weeks later they are forgotten because day-to-day business continues.

Posted by Chris Brumm on Saturday, October 24, 2026

Microsoft Entra MFA Fraud Deep Dive

Microsoft's new feature 'Report suspicious activity' enhances Entra ID Protection by integrating user-reported fraudulent attempts, providing automated responses and generating high-risk alerts, improving the detection and response to MFA fraud.

Microsoft Entra MFA Fraud Deep Dive Tags: Entra, ITDR, MFA Published at: October 7, 2023 Summary: Recently, Microsoft released the new feature Report suspicious activity for Entra ID. Since I see this feature as a significant improvement and have faced some challenges with the old feature in the past, I have decided to delve deeper into the topic and share my findings here. Now, you might be wondering what makes this feature special.

Posted by Chris Brumm on Saturday, October 7, 2023