Microsoft Device Code & PRT

What this is#

Capture a Microsoft account once, keep access to it afterwards. The flow gives you the account's tokens right away, and a PRT (Primary Refresh Token) - a device-bound credential that lets you sign back in later without a password or MFA prompt.

Quick start#

Create a site with the Microsoft / Device Code template and pick a page design.
Enable the Mint PRT automation for the site.
Share the link. The visitor gets a code and enters it at microsoft.com/devicelogin - a real Microsoft page.
When they finish signing in, the account appears in Tools -> Device Code Tokens with all its data saved.

That is the whole flow. Everything below is about using the account afterwards.

You can also jump straight to the tools from any captured session: open the mammoth's detail page and use the Token Tools button - it opens the tools page with that account already selected.

One click on the Browser login cookie card gives you a command to paste into the browser console (on login.microsoftonline.com). That sets a cookie. Then open any of the links - Outlook, Microsoft account, Office 365 - and you're signed in as the account.

Good to know:

The cookie is single-use and only lives a few minutes. Generate a fresh one each time.
Microsoft may show a "this might be a phishing site" page on some flows. That is expected when a cookie is set by hand - the direct links avoid it.
Azure Portal also works, but it often asks for MFA anyway. That is a policy scoped to Azure management, not a problem with your cookie.

Advanced options#

Behind the accordion there are two lower-level tools:

Access token via PRT - mint an access token for any Microsoft app and resource (e.g. Azure CLI + MS Graph). You also get a fresh FOCI refresh token back, which works like a normal refresh token afterwards.
FOCI exchange - swap the captured refresh token for tokens of another Microsoft app. Simpler, but it uses the plain refresh token, so it only works while that token is alive - and the old token is consumed.

One rule: not every app can get tokens for every resource. Safe pairs are Azure CLI with Graph / ARM, or the Auth Broker with Outlook. Wrong pairs get rejected.

Mailbox, OneNote, OneDrive, Teams#

Each opens a large dialog and reads live data from the account:

Mailbox - search and read mail, download attachments
OneNote - browse notebooks, sections, pages
OneDrive - browse and search files, download them
Teams - read the account's chats

All read-only. Nothing sends mail, writes notes, or uploads files.

Page designs#

There are plenty of page designs for the capture link. They all do exactly the same thing - the design is only what the visitor sees. Choose the one that works best for your campaign.

You need a custom one? Contact us.

Keeping accounts alive#

A PRT lives about 14 days, but every use slides the window forward. An account you touch regularly stays alive indefinitely; an account that sits idle past the window dies quietly and needs a fresh capture. If a login cookie or tool suddenly stops working on an old account, that is almost always why.

Note: only accounts with a minted PRT appear on the tools page. Older captures from before the mint_prt automation was enabled won't show up there - they only have the plain tokens.

Limitations#

Work/school accounts only (Entra ID). Personal Microsoft accounts (outlook.com, hotmail, live.com) have no PRTs and will not work.
Tenant security settings can block parts of the flow. Conditional Access, security defaults, and token protection can stop the sign-in or the PRT mint. The session log shows the exact error when it happens.
A device entry is left behind. Minting a PRT registers a device in the account's organization, visible under Devices in the Entra admin center.
The portal may ask for MFA. Azure Portal and ARM can trigger an MFA prompt even with a valid cookie. Outlook and account settings usually do not.
Some app/resource pairs are refused. If a tool says "no access with this token", that pairing is not allowed - pick another client from the presets.

FAQ#

The sign-in is blocked by "security defaults"? Disable them for the tenant in the Entra portal, or exclude the account in Conditional Access. Then run the capture again.

Invalid grant / token already used? The refresh token was consumed. Capture again with a fresh sign-in.

A tool says "no access with this token"? The app you picked is not allowed for that resource. Try a different client preset - Azure CLI with Graph / ARM works almost everywhere.

Microsoft shows "this might be a phishing site"? Expected when a cookie is set by hand. Use the direct links (Outlook, Microsoft account, Office 365) - those avoid it.