Bug report: federated auth with working username/password without MFA works for pac cli but not for m365 login

Priority

(Urgent) I can't use the CLI

Description

$securePsw = ($env:password | ConvertTo-SecureString -AsPlainText -Force)
Add-PowerAppsAccount -Endpoint prod -tenantId $env:TENANTID -Username $env:USERNAME -Password $securePsw

this works but requires Microsoft.PowerApps.Administration.PowerShell module that is windows-specific.

if i use the pac cli that is cross platform, the login perfectly works and i can do whatever i want with the cli but it doesn't have the option to "enable" or "disable" cloud flow for a specific power platform environment.

pac auth create -un $username -p $password --tenant $tenantId --accept-cleartext-caching

and that is precisely why i stumbled upon the m365 cli.

but only with your cli, with the same username and password and using the same appId for the same tenant(specifying the tenant or not doesn't change the result):

m365 login --authType password --userName $env:USERNAME --password $env:password

fails to login and gives back
Error(s): 50126 - Timestamp: 2025-01-31 09:30:14Z - Description: AADSTS50126: Error validating credentials due to invalid username or password.

this is also the actual c# code i used for a different use case, and it still works fine:

var authBuilder = PublicClientApplicationBuilder.Create(clientId)
                             .WithAuthority(AadAuthorityAudience.AzureAdMultipleOrgs)
                             .Build();
var scope = "https://service.powerapps.com//.default";
string[] scopes = [scope];

AuthenticationResult token =
   await authBuilder.AcquireTokenByUsernamePassword(scopes, usernameSecret.Value, passwordSecret.Value).ExecuteAsync();

// here we call https://api.bap.microsoft.com/providers/Microsoft.BusinessAppPlatform/scopes/admin/environments?%60$expand=permissions&api-version=2020-08-01 using the auth token
// because it's what the pac cli does and we want to use the same api in the same way for other purposes
HttpClient client = new();
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token.AccessToken);
client.DefaultRequestHeaders.Add("Accept", "application/json");

var response = await client.GetAsync("https://api.bap.microsoft.com/providers/Microsoft.BusinessAppPlatform/scopes/admin/environments?%60$expand=permissions&api-version=2020-08-01");
var responseObj= await response.Content.ReadFromJsonAsync<EnvironmentsResponse>();

Steps to reproduce

using valid federated credentials
m365 login --authType password --userName $env:USERNAME --password $env:password

Expected results

i should be able to login

Actual results

fails to login and gives back
Error(s): 50126 - Timestamp: 2025-01-31 09:30:14Z - Description: AADSTS50126: Error validating credentials due to invalid username or password.

Diagnostics

No response

CLI for Microsoft 365 version

latest

nodejs version

lts

Operating system (environment)

Linux

Shell

PowerShell

cli doctor

No response

Additional Info

No response

The relevant entry point is m365 login --authType password ...; first reproduce it with the federated credentials and compare its behavior with the working pac CLI and C# AcquireTokenByUsernamePassword flow described here. Done means the CLI accepts the same valid credentials on Linux without MFA and no longer returns AADSTS50126.