ROPC – So, you think you have MFA? Common Azure OAuth misconfiguration (embracethered.com)