code: func deviceFlowAuth(oauthCfg azure.OAuthConfig, clientID, resource string) (*azure.ServicePrincipalToken, error) {
  	cl := oauthClient()
  	deviceCode, err := azure.InitiateDeviceAuth(&cl, oauthCfg, clientID, resource)
  	if err != nil {
  		return nil, fmt.Errorf("Failed to start device auth: %v", err)
  	}
  	log.Debug("Retrieved device code.", logutil.Fields{
  		"expires_in": to.Int64(deviceCode.ExpiresIn),
  		"interval":   to.Int64(deviceCode.Interval),
  	})
  
  	// Example message: “To sign in, open https://aka.ms/devicelogin and enter
  	// the code 0000000 to authenticate.”
  	log.Infof("Microsoft Azure: %s", to.String(deviceCode.Message))
  
  	token, err := azure.WaitForUserCompletion(&cl, deviceCode)
  	if err != nil {
  		return nil, fmt.Errorf("Failed to complete device auth: %v", err)
  	}
  
  	spt, err := azure.NewServicePrincipalTokenFromManualToken(oauthCfg, clientID, resource, *token)
  	if err != nil {
  		return nil, fmt.Errorf("Error constructing service principal token: %v", err)
  	}
  	return spt, nil
  }
docs: // deviceFlowAuth prints a message to the screen for user to take action to
  // consent application on a browser and in the meanwhile the authentication
  // endpoint is polled until user gives consent, denies or the flow times out.
  // Returned token must be saved.