Protocol tracking
Protocol tracking is a Microsoft Entra mechanism that preserves a session's device-code or authentication-transfer origin so authentication-flows policies can apply to later requests.
Why a refresh request can hit a device-code policy
Entra remembers when a session began through device code flow or authentication transfer. That origin survives subsequent token refreshes, so an authentication-flows policy can apply even when the current request uses another flow.
Microsoft gives this example: a policy permits device code flow for SharePoint but blocks it elsewhere. A user starts an allowed SharePoint session, then tries to access Exchange within that session. Exchange access can be blocked because the session retains its device-code origin.
Two fields answer different questions
Authentication protocol describes the request you are looking at. Original transfer method shows the session’s tracked origin. Read those alongside the Conditional Access result before treating a block as a policy error.
Protocol tracking does not itself mean a session is malicious or blocked; an applicable policy still determines enforcement. It also says nothing about whether the device is registered, joined, or compliant. Those are separate device properties, not stages of this tracking mechanism.