Resource Owner Password Credential flow

Obsolete: The Resource Owner Password Credential (ROPC) flow is obsolete. Support for this flow will be removed in the next release because Microsoft's initiative to enforce multifactor authentication is incompatible with password-only sign-in. Use an interactive, broker-based, device code, managed identity, or on-behalf-of flow instead.

ROPC is incompatible with modern identity protections such as MFA, Conditional Access, passwordless authentication, and many federated sign-in configurations. The example below is retained only for legacy or test scenarios until support is removed.

This sample uses ROPC to get token to access Teams REST API that expects authentication with user account with Teams administrative role, and fetches list of Teams users.
Note: App registration used in the sample must have granted user_impersonation scope for Skype and Teams Tenant Admin API and allow ROPC flow. User account in credentials must have Teams administrative role in tenant.

$creds = Get-Credential
#create app registration in Microsoft Entra ID and allow ROPC on it only if it is explicitly required
$clientId = 'your custom client id'
New-AadAuthenticationFactory `
    -TenantId 'mytenant.com' `
    -ClientId $clientId `
    -ResourceOwnerCredential $creds `
    -DefaultScopes '48ac35b8-9aa8-4d74-927d-1f4a14a0b239/.default' `
| Get-AadToken `
| Test-AadToken -PayloadOnly

#get list of Teams users with token obtained with ROPC flow
$headers = Get-AadToken -asHashTable
$response = Invoke-RestMethod -Uri 'https://api.interfaces.records.teams.microsoft.com/Teams.User/users' -Headers $headers
$response.users