> ROPC - So, you think you have MFA?

This post will highlight a pattern I have seen across multiple production Microsoft Azure Active Directory tenants which led to MFA bypasses using ROPC. The key take-away: Always enforce MFA! Sounds easy, but there are often misconfigurations and unexpected exceptions. So, test your own AAD tenant for ROPC based MFA bypass opportunities. Github: https://github.com/wunderwuzzi23/ropci Update: The latest free issue of Pentest Magazine has a ropci article. Check it out. What is ROPC?