ROPC - So, you think you have MFA?
Summary
ROPC (Resource Owner Password Credentials, an OAuth2 method that sends usernames and passwords directly to get access tokens) can bypass multi-factor authentication (MFA, a security check requiring multiple forms of verification) in Microsoft Azure Active Directory if not properly configured, because over 50 default apps in every tenant support ROPC and may not enforce MFA. The post warns that ROPC should not be used and recommends testing your Azure setup for this vulnerability using the ropci tool.
Solution / Mitigation
The source mentions testing as a mitigation: 'Always enforce MFA' and 'test your own AAD tenant for ROPC based MFA bypass opportunities.' Additionally, the post states 'ROPC MUST NOT be used' as a general security principle. However, no specific configuration steps, patches, or enforcement mechanisms are explicitly described in the provided text.
Classification
Original source: https://embracethered.com/blog/posts/2022/ropci-so-you-think-you-have-mfa-azure-ad/
First tracked: February 12, 2026 at 02:20 PM
Classified by LLM (prompt v3) · confidence: 95%