Alternative to ROPC for Native WeChat Mini Program Authentication with Azure AD B2C

Summer Lang 0 Reputation points
2026-08-28T08:48:59.3433333+00:00

We are developing a native WeChat Mini Program for consumer-facing users in China.

The existing web/app architecture uses Azure AD B2C (Microsoft Entra External ID) as the customer identity platform. Users need to register and sign in using email and password, and the Mini Program needs to obtain Azure AD B2C tokens for subsequent API access.

During our technical investigation, we found that Microsoft officially recommends against using the Resource Owner Password Credentials (ROPC) flow and has marked it as deprecated due to security risks and its incompatibility with MFA.

Although Microsoft recommends migrating away from ROPC, we would like to better understand the supportability roadmap.

Is there any published retirement, deprecation, or end-of-support timeline for ROPC?

Is there an officially recommended replacement for ROPC when integrating Azure AD B2C / Microsoft Entra External ID with a native WeChat Mini Program?

Azure
Azure

A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.