It works, and because nothing’s broken, nobody has touched it. But Microsoft has tightened the rules, and two recent changes move ROPC from “deal with it eventually” to something you should be planning for now.
What changed in the admin portal?
Microsoft is rolling out mandatory MFA for administrative access across Entra ID in phases. It’s scoped to specific admin apps and portals, not every app in your tenant.
ROPC flows that hit in-scope admin interfaces will start to fail. Conditional Access exclusions won’t save you: enforcement happens at the resource, where the downstream service rejects tokens that don’t carry an MFA claim. Because ROPC authenticates as the user rather than the app, the user’s token still hits that check.
If you have service accounts or automation using ROPC against admin interfaces, audit them now.
What changed in MSAL?
In Microsoft.Identity.Client 4.74.0, AcquireTokenByUsernamePassword was formally deprecated. It still works today, but future versions may remove it. Library deprecation is separate from protocol enforcement, but both point in the same direction.
Why ROPC is fundamentally the problem
ROPC requires the application to handle the user’s plaintext credentials. It doesn’t support MFA and isn’t compatible with Conditional Access. It was always a pragmatic workaround for legacy scenarios, and Microsoft’s position is clear: don’t use it for new applications, and migrate existing ones.
So what can you do?
For service accounts and automation, move to the client credentials flow, where the application authenticates as itself using a certificate or secret, and Conditional Access applies. For user-delegated scenarios, use the authorisation code flow with PKCE.
If migration isn’t on your roadmap yet, at a minimum:
- Document every application using ROPC and what it accesses.
- Identify service accounts that fall under admin-portal MFA enforcement.
- Watch Microsoft’s deprecation announcements. Notice has historically been 12 months or more, but the scope keeps expanding.
- Treat deferral as an active, monitored decision, not a default.
What it means for Australian organisations
The ASD Essential Eight requires MFA from Maturity Level 1 for users signing in to internet-facing services, and phishing-resistant MFA at higher levels. ROPC can’t do MFA, so if you’re running it in production at any maturity level, it should be documented and managed as a gap.
The enforcement timeline is Microsoft’s. The risk of being caught unprepared is yours.