Username and password (ROPC) authentication with MSAL.NET

In your desktop applications you can use the username and password flow (also known as Resource Owner Password Credentials, or ROPC) to acquire a token silently. No UI is required when using the application.

Warning

The ROPC flow is not recommended as the application will be asking a user for their password directly, which is an insecure pattern. For more information about the risks and challenges the ROPC flow poses, refer to "What’s the solution to the growing problem of passwords? You, says Microsoft". The preferred flow for acquiring a token silently on Windows is using the Windows authentication broker. Alternatively, developers can also use the Device code flow on devices without access to the web browser.

Although the ROPC flow is useful in limited cases where developers want to provide their own UI for credential acquisition, there are a number of important trade-offs. By using the flow, developers are giving up a number of things:

• Core tenets of modern identity, such as paswordless patterns - if the password gets phished, it can then be replayed.
• Users who need to do Multi-factor Authentication (MFA) won't be able to sign-in, as there are no interaction affordances.
• Single Sign-On (SSO) support.

Constraints

In addition to the Integrated Windows Authentication constraints, the following also apply:

• Available starting with MSAL 2.1.0.
• Not compatible with conditional access and multi-factor authentication. As a consequence, if the app runs in a Microsoft Entra tenant where the tenant admin requires multi-factor authentication, the flow cannot be used.
• Only available for work and school accounts and not personal Microsoft accounts.
• Available on .NET Framework and .NET/.NET Core, but not for Universal Windows Platform (UWP) applications.

Authority implications

Tenant	Description	Supports ROPC
common	Work, school, and personal accounts.	❌ No
organizations	Work and school accounts.	✅ Yes
consumers	Personal Microsoft accounts.	❌ No
Specific tenant (GUID or fully-qualified name, like contoso.onmicrosoft.com)	Work and school accounts from the specific tenant.	✅ Yes

Note

To learn more about using the ROPC flow with Azure AD B2C, refer to Use MSAL.NET to sign in users with social identities.

Usage

Application registration

During the app registration, in the Authentication section for your application, choose Yes as the answer to the question Allow public client flows (which includes App collects plaintext password (Resource Owner Password Credential Flow)).

Note

If your application supports authentication with personal Microsoft accounts, ROPC flow will not be available even if your application also supports authentication with work and school accounts.

Sample code

ROPC flow is only available for public client applications. To use it, developers can leverage the PublicClientApplication class, which contains the AcquireTokenByUsernamePassword method.

The following sample showcases a simplified use-case:

Note

Replace /contoso.com in the authority URL with your tenant ID or /organizations.

The following sample presents the most current use-case:

static async Task GetATokenForGraph()
{
    string authority = "https://login.microsoftonline.com/contoso.com";
    string[] scopes = new string[]
    {
        "user.read"
    };

    IPublicClientApplication app;
    app = PublicClientApplicationBuilder.Create(clientId).WithAuthority(authority).Build();

    var accounts = await app.GetAccountsAsync();
    AuthenticationResult result = null;

    if (accounts.Any())
    {
        result = await app.AcquireTokenSilent(scopes, accounts.FirstOrDefault()).ExecuteAsync();
    }
    else
    {
        try
        {
            result = await app.AcquireTokenByUsernamePassword(scopes, "joe@contoso.com", "joepassword").ExecuteAsync();
        }
        catch (MsalException)
        {
            // Handle various potential exceptions.
        }
    }
    Console.WriteLine(result.Account.Username);
}

Protocol documentation

See Azure Active Directory v2.0 and the OAuth 2.0 resource owner password credential to learn more about the underlying protocol.

End-to-end samples

Sample	Platform	Description
active-directory-dotnetcore-console-up-v2	Console (.NET Core)	.NET Core console application letting a user signed-in with the Azure AD v2.0 endpoint using username and password to acquire a token for Microsoft Graph. ! Console app topology