aka.ms/devicelogin explained
Updated
aka.ms/devicelogin is the Microsoft short link for signing in to a device or app that shows you a code instead of a sign-in box. You open the link on another device, enter the code, and sign in there.
Where the link goes
When we checked on 16 October 2026, aka.ms/devicelogin forwarded to login.microsoftonline.com/common/oauth2/deviceauth, Microsoft's sign-in service for work and school accounts (Microsoft Entra ID). The page asks you to enter a code. The longer address microsoft.com/devicelogin leads to the same kind of page. Always check the address bar: the code should only ever be typed into a page on a Microsoft-owned address such as login.microsoftonline.com.
What the code sign-in is for
Some devices and tools cannot show a normal sign-in page or are awkward to type on. Microsoft's developer documentation gives smart TVs, IoT devices and printers as examples. For these, Microsoft uses what it calls the device code flow:
- The device or app shows a short code and tells you to visit aka.ms/devicelogin (or microsoft.com/devicelogin).
- On a phone or computer, you open that address and type the code.
- You sign in with your account and approve the request, including any two-step verification your organization requires.
- The original device is signed in automatically. It has been waiting in the background for you to finish.
The same flow is common with command-line tools. Microsoft's Azure CLI documentation, for example, says that when az login cannot open a browser it falls back to the device code flow and tells you to open https://aka.ms/devicelogin and enter the code shown in the terminal. You can also request it on purpose with az login --use-device-code.
How long the code lasts
Codes are short-lived on purpose. Microsoft's protocol documentation gives 15 minutes as the default time a user has to sign in once the code is requested, and individual apps can show their own limit. If the page says the code has expired or is not valid, go back to the device or app, start the sign-in again to get a fresh code, and enter it straight away. Also check that you typed it exactly, since the code is only valid for the session that created it.
devicelogin or remoteconnect?
Both links use a code shown on one screen and a sign-in on another, so they are easy to mix up. In our tests, aka.ms/remoteconnect opened a page on login.live.com, the sign-in for personal Microsoft accounts that Minecraft uses on consoles. aka.ms/devicelogin opened the Microsoft Entra sign-in that is mostly used with work and school accounts and developer tools. Use whichever link your screen shows; they are not interchangeable.
Why it is a favourite of scammers
Because the code sign-in happens on a genuine Microsoft page, attackers try to abuse it. The trick is simple: they start a sign-in on their own device, then send you the code with a convincing message such as a fake meeting invite, a document to "verify", or a caller posing as IT. If you enter their code and sign in, you sign their device in to your account. Microsoft's own Entra documentation describes device code flow as a high-risk method that can be part of a phishing attack and recommends that organizations block it wherever it is not needed.
A device code is not a verification code
Two kinds of code are easy to confuse. The device code is a short code a device or app shows you, which you type at aka.ms/devicelogin to sign that device in. A verification code, such as a 6-digit number from Microsoft Authenticator or a text message, proves your identity during a sign-in you are doing yourself. Neither should ever be passed between people. If anyone asks you to type, read out or forward either kind of code, treat it as an attempt to get into your account.
If it is not working
- Code expired or invalid: restart the sign-in on the device to get a new code and enter it quickly.
- Blocked by your organization: many organizations use Conditional Access policies to limit or block device code sign-in, as Microsoft recommends. If you see a block message, the device or tool may not be approved for your account. Your IT team decides this; there is no setting you can change yourself.
- Wrong account: if your browser signs you in automatically with another account, use a private window or pick the right account when asked.
- The device keeps waiting: make sure you completed every prompt on the sign-in page, including any approval in the Microsoft Authenticator app (see aka.ms/authapp).
New to these links? Read how to use an aka.ms link, or browse the aka.ms links directory.
Sources
Frequently asked questions
Is aka.ms/devicelogin a real Microsoft link?
Yes. When we checked on 16 October 2026 it forwarded to login.microsoftonline.com, Microsoft's sign-in service. The risk is not the page but codes that someone else sends you.
Someone emailed me a code to enter at aka.ms/devicelogin. Should I?
No. Only enter a code shown on a device or app you started yourself. A code sent by someone else can sign their device in to your account.
Why does Azure CLI ask me to use aka.ms/devicelogin?
Microsoft says az login falls back to the device code flow when it cannot open a browser. You can also choose it with az login --use-device-code.
How long is the code valid?
Not long. Microsoft's documentation gives 15 minutes as the default, and apps may set their own limit. If it expires, start the sign-in again for a new code.