// GLOSSARY

Device Code Flow (Device Authorization Grant)

An OAuth 2.0 flow (RFC 8628) designed for devices with limited keyboard or browser interaction (smart TVs, consoles, CLI tools), where the user approves a code on a separate device. Its legitimate purpose is useful, but its value to an attacker lies in this asymmetry: the flow carries no attacker-owned link, so it never triggers the 'do not click the suspicious link' reflex organizations have trained for years. The user approves a genuine code on a familiar, real sign-in screen; yet the session approved belongs to the attacker. Because this technique bypasses the link-based detection controls of phishing, it is assessed as a separate entry surface in initial-access scenarios; its defense is built by bringing this flow within conditional-access policy coverage and by monitoring device-code requests.