Why doesn't this flow require the user to fully login before _requesting_ a device code?
> Only allow device code flow where necessary. Microsoft recommends blocking device code flow wherever possible. Where necessary, configure Microsoft Entra ID’s device code flow in your Conditional Access policies.
https://www.microsoft.com/en-us/security/blog/2025/02/13/sto...