Working alternative to the Resource Owner Password Credentials (ROPC) grant type

Question

Hello!
I'm trying to create an approval item using Microsoft Graph: Create approvalItem

For some reason, only the Delegated permission type is available.
The only request I’ve found that works in this case (able to obtain a token with delegated permissions assigned to the app registration) and runs without user interaction uses ROPC:
$headers = @{

"Content-Type" = "application/x-www-form-urlencoded"

}

$body = @{

grant_type = "password"

username = $username

password = $password

scope = $scope

client_id = $clientId

client_secret = $clientSecret

}

$response = Invoke-RestMethod -Method Post -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" -Headers $headers -Body $body

$accessToken = $response.access_token

However, ROPC requires disabling MFA for the user and is not recommended by Microsoft.

Are there any working authentication alternatives to ROPC that support Delegated permissions and can be executed without user interaction?

Answer 1

No, not really. Flows used with delegate permissions are intended to be interactive, so for a fully automated solution you have to resort to workarounds such as using ROPC or "capturing" the refresh token of the initial interactive auth and reusing it. No good alternatives, at least until Microsoft introduces support for application permissions.