I'm modernizing authentication because SMS-based MFA is being phased out. Windows passkeys work well for our regular users, especially when they don't have company apps or Microsoft Authenticator on a personal or corporate phone. However, one of our Teams desk phones was signed out during testing, and I can no longer sign it back in. It appears that Teams phone provisioning relies on device code flow, while our recommended Conditional Access policy blocks device code authentication. Is there a secure way to allow device code flow only for Teams phones or trusted office locations while keeping the phishing-resistant sign-in requirements for everyone else?
3 Answers
There is Microsoft guidance for blocking device code flow broadly while allowing it for Teams devices. The safest configuration is to duplicate the managed policy, limit the exception to the required Teams phone scenarios, and use trusted locations or groups wherever possible.
This is generally handled through Conditional Access. Device code flow only needs to be blocked for users and scenarios that don't require it, so a narrowly scoped exception may be appropriate for Teams phone sign-ins.
Teams room or desk-phone accounts usually need an exception in the Conditional Access policy. A practical approach is to scope the exception to a dedicated group of phone users or service accounts, and restrict it to trusted network locations rather than excluding everyone.
Our setup is user-based, and most of those users have desk phones, so allowing the trusted office IP was the workable option for now. I may tighten it to a dedicated group once the migration is further along.
That was the issue in my case. I copied the Microsoft-managed device code policy and changed it to allow our trusted office IP ranges. We're working through a lot of older policies, so I wanted to avoid changing the default behavior too broadly.