In order to protect against the specific attack vector used by Storm-2372, Microsoft recommends: Disabling device code flow wherever possible. Provide phishing training to all users. Revoke access ...