Block device code flow in old Microsoft Entra tenants

Question

Block device code flow in old Microsoft Entra tenants

Karl Emil Nikka 5

I read that new Microsoft Entra tenants (created 1 July 2026 or later) no longer need Entra P1 to block device code flow. It is now part of the security defaults.

Starting July 1, 2026, all new Microsoft Entra tenants block device code flow as part of security defaults. Applications or devices that depend on device code flow won't be able to complete sign-in while security defaults are enabled.

Is there a way to get the same protection for older tenants? I have to older tenants with security defaults enabled since many years. Both of them still allow device code flow-based authentication. Disabling and re-enabling security defaults didn’t help.

Fabrizio Lo Conte 0 Reputation points

2026-11-03T08:44:30.8733333+00:00

I've the same problem, is there any solution ? Since April that have been proposed ?

1 answer

Your answer

Fabrizio Lo Conte 0 Reputation points

2026-11-03T08:44:30.8733333+00:00

I've the same problem, is there any solution ? Since April that have been proposed ?

Answer 1

Marius Vaičeliūnas 230

Hello,

Thank you for reaching out with your question.

Unfortunately, blocking device code flow using Security Defaults for tenants created before 1 July 2026 isn't supported.

The only solution as of now is to use Entra ID P1 license and conditional access policy.

If you found this reply helpful, please consider upvoting or accepting it as the answer.

Best regards.

Fabrizio Lo Conte 0 Reputation points

2026-11-03T15:46:01.74+00:00
Thank you for the clear answer, I appreciate it.

As a long-term customer, two things would really help:

A timeline for when this Security Defaults protection will be available to all tenants. It is hard to understand that new customers get better security for free than long-standing ones, especially while device code phishing campaigns are active (one of our employees was targeted this week).

Until then, if we have to move to Entra ID P1 and Conditional Access, clear documentation listing exactly which policies to create to keep at least the same protection level as Security Defaults, plus the device code flow block. Disabling Security Defaults means rebuilding every protection one by one, and an official checklist would avoid gaps.

Thanks again.