Azure / Azure/azure-cli

`az login`: Deprecate and remove Resource Owner Password Credentials flow support

Open
#28,252 3 comments 0 reactions 1 assignee Claimed by @jiasli View on GitHub
Account act-identity-squad Auto-Assign Azure CLI Team feature-request OKR Candidate
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Related command**
`az login`

**Is your feature request related to a problem? Please describe.**
`az login` supports Resource Owner Password Credentials (ROPC) flow, which is also known as username password flow:

```
az login --username xxx --password xxx
```

ROPC flow is not a recommended flow (https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth-ropc):

> [!WARNING]
> Microsoft recommends you do _not_ use the ROPC flow. In most scenarios, more secure alternatives are available and recommended. This flow requires a very high degree of trust in the application, and carries risks that are not present in other flows. You should only use this flow when other more secure flows aren't viable.

There are also some recent changes:

1. We are enforcing MFA on our test tenant.
2. We are investigating enforcing MFA on client tools' first party applications, including Azure CLI and Azure PowerShell.
3. MSAL doesn't use broker for ROPC flow anymore: https://github.com/AzureAD/microsoft-authentication-library-for-python/pull/569

**Describe the solution you'd like**

ROPC flow inherently doesn't work with MFA (https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth-ropc):

> [!IMPORTANT]
> * If users need to use multi-factor authentication (MFA) to log in to the application, they will be blocked instead.

As we are broadening the scope of MFA enforcement, we should consider deprecating and removing ROPC flow support.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.