The attacker then invites the victim to an online meeting, where the victim is prompted to complete a device code authentication ... Disabling device code flow wherever possible.