Policies/NSP-BASE-FLOW-01.psd1
|
@{ Id = 'NSP-BASE-FLOW-01' Name = 'Block device code flow and authentication transfer' Version = 1 Description = 'Blocks signing in with a device code (entering a code shown on another device) and transferring a sign-in from one device to another. Device code phishing uses the first.' Notes = 'New with the module (2026-10-09), from the common baselines. Teams Rooms, some shared devices, and some command-line tools sign in with a device code; exclude those accounts on this policy (Change who a policy applies to).' LegacyNames = @('CIS - Block device code flow signin') DefaultState = 'reportOnly' Users = @{ IncludeUsers = @('All') ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}') } Applications = @{ Include = @('All') } AuthenticationFlows = @('deviceCodeFlow', 'authenticationTransfer') Grant = @{ Operator = 'OR' BuiltInControls = @('block') } } |