LSHIY - Azure CLI ROPC OAuth Flow Used to Bypass MFA in M365

Ethan Andrews@eandrews

•updated Jul 1, 2026•13•0•20

Detects non-interactive sign-ins to Microsoft 365 using the OAuth Resource Owner Password Credentials (ROPC) flow via the Azure CLI. This legacy authentication method enables attackers to bypass multi-factor authentication (MFA) by submitting credentials directly to the authentication endpoint, a technique observed in password spraying campaigns.