---
title: "Configure Microsoft Entra ID ROPC as an Identity Provider"
slug: "ropc-doc"
updated: 2026-09-16T09:17:03Z
published: 2026-09-16T09:17:03Z
canonical: "help.scalefusion.com/ropc-doc"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.scalefusion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Microsoft Entra ID ROPC as an Identity Provider

## 

**ROPC (Resource Owner Password Credentials)** is an authentication method that allows users to sign in to OneIdP using their **Microsoft Entra ID credentials**.

With ROPC, the user's Microsoft Entra ID username and password are validated directly with Microsoft Entra ID. This allows organizations using Microsoft Entra ID as their identity source to authenticate users through the OneIdP login page using their existing Entra ID password.

OneIdP also supports configuring ROPC with **Microsoft Entra ID Conditional Access policies** using a custom API and application registration. This helps organizations using Conditional Access policies manage ROPC authentication without affecting the background authentication required by OneIdP.

To use ROPC as an Identity Provider, you need to follow these steps:

- **Step 1:** Create an application registration and configure a custom API.
- **Step 2:** Create another application registration that uses the custom API and its scope.
- **Step 3:** Exclude the newly created custom API from Conditional Access policies that are applied to All Cloud Apps.
- **Step 4:** Configure Microsoft Entra ID ROPC as an Identity Provider on the Scalefusion Dashboard.

These are explained in detail below

## Step 1: **Create an Application Registration with a Custom API**

1. Log in to the **Microsoft Entra Portal:** ([https://portal.azure.com/#home](https://portal.azure.com/#home))
2. Navigate to **App registrations**.
3. Click **+ New registration** and enter the following details and click **Register**.

a. **Name**: OneIdP Custom API Application

b. **Supported account types**: Accounts in this organizational directory only (Single tenant)

c. **Redirect URI**: Leave blank (do not configure)

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-XGPWDU07.png)

4. In the left sidebar, select **API permissions** and ensure admin consent is granted for User.Read

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-TW2RLTHN.png)

5. In the left sidebar, select **Expose an API**. Click **Add** next to **Application ID URI** (accept the default value) and click **Save**.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/ropc-doc-image-s0t50f3p.png)

6. Click **+ Add a scope** and configure:

a. **Scope name:** oneidpscope

b. **Who can consent:** Admin and users (or Admins only)

c. Fill in the required **Admin consent display name** and **description**.(ex - Accepted by Admin )

d. Ensure **State** is set to **Enabled**.

e. Click **Add scope**.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-AB384JH1.png)

7. Copy the generated **Scope URI** and save it for your OneIdP Identity Provider configuration.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-X64AM7R1.png)

This application allows the application that calls the custom scope to borrow additional API permissions.

## **Step 2: Create an Application Registration to Call a Custom Scope**

1. Log in to the **Microsoft Entra Portal:** ([https://portal.azure.com/#home](https://portal.azure.com/#home))
2. Navigate to **App registrations**.
3. Click **+ New registration** and enter the following details and Click **Register**.

a. **Name:** OneIdP ROPC Application

b. **Supported account types:** Accounts in this organizational directory only (Single tenant)

c. **Redirect URI:** Leave blank (do not configure)

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-4R2PDLP4.png)

4. **Enable** Public Client Flows:

a. In the left sidebar, select **Authentication**.

b. Under **Settings**, enable the toggle **Allow public client flows**,

c. Click **Save**.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/ropc-doc-image-1e59t1pb.png)

5. **Configure** API Permissions:

a. In the left sidebar, select **API permissions**. Click Grant admin consent for User.Read.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-VM9EOM5L.png)

b. Click **+ Add a permission** and choose the **APIs my organization uses** tab. Search for and select **OneIdP Custom API Application**.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-BE55WBKI.png)

1. Select **Delegated permissions**, check the box for **oneidpscope**, and click **Add permissions**.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-0XFRLG5J.png)

d. Click **Grant admin consent** for the same.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-UK9Y0ZSK.png)

## **Step 3: Excluding the Custom API app from Conditional Access Policies**

1. Log in to the **Microsoft Entra Portal.** Navigate to **Microsoft Entra Conditional Access**.
2. Locate and click on any active policy where **Target resources** include **All cloud apps**.
3. Under **Target resources**, click the **Exclude** tab.
4. Select **Exclude cloud apps** > **Select Specific Resources.**
5. Search for and select **OneIdP Custom API Application**
6. Click **Select** and then click **Save**.
7. Repeat this exclusion process for any other active Conditional Access policies scoped to **All cloud apps**.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/ropc-doc-image-vof6t469.png)

## Step 4: **Configure Microsoft Entra ID ROPC as an Identity Provider on the Scalefusion Dashboard**

1. Navigate to **OneIdP > Identity Provider**.
2. Click the **New Provider** button.
3. Select **Microsoft 365/Microsoft Entra – ROPC** and click **Configure**.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-Y467P7PR.png)
4. Enter a name for the Identity Provider configuration to easily identify it.
5. Enter the **Tenant ID** of your Microsoft Entra ID account.
6. Enter the Client ID of the **OneIdP ROPC Application** created in [Step 2](/v1/docs/ropc-doc#step-2-create-an-application-registration-to-call-a-custom-scope).
7. **API Scope:** Enter the API scope configured in the **OneIdP Custom API Application** created in [Step 1](/v1/docs/ropc-doc#making-oneidp-compatible-with-microsoft-conditional-access-policies).
8. Click **Save** to complete the configuration.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-GFG0CW03.png)

# 

## **User Login Flow**

When the user enters their email on the service login page, they will be redirected to OneIdP. From there, OneIdP will redirect the user to the chosen identity provider (**Microsoft 365/ Microsoft Entra - ROPC**, in this case) for authentication. Once the identity provider authenticates the user, then user will be asked for OneIdP Compliance. Once the compliance is pass then user can access the service.

> **Note:**
> 
> If a user's password is reset from the Microsoft Entra admin portal, the user must set a new password before attempting to log in through OneIdP.
> 
> If the user has not completed the password change, authentication through OneIdP will fail, and the user will not be able to log in.