title: Unable to get Token with Work Account for Teams OnlineMeeting API within MS Graph platform
body: <p><strong>Business Requirement:</strong>
  We want to replace our Skype meeting URL with Teams meeting on our production system(within a ABAP daemon service without user integration). So I am trying to integrate with Teams using Microsoft Graph API to be able to generate one online meetings. Then this online meeting URL will send to our customer with a mail.</p>
  
  <p><strong>Target Graph API</strong>: For MS Graph API V1.0 verion, I think this in only one option <a href="https://docs.microsoft.com/en-us/graph/api/application-post-onlinemeetings?view=graph-rest-1.0&amp;tabs=http" rel="nofollow noreferrer">Create onlineMeeting</a>.(Graph API with /beta version is not a good option for production usage).
  According the MS Graph documentation V1.0 <a href="https://docs.microsoft.com/en-us/graph/api/application-post-onlinemeetings?view=graph-rest-1.0&amp;tabs=http" rel="nofollow noreferrer">Create onlineMeeting</a>, this API only support permissions with Delegate type. I think we could only use use <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-authentication-flows#usernamepassword" rel="nofollow noreferrer">username/password authentication flow</a>. Correct me if I'm wrong.</p>
  
  <p><strong>Issues</strong>: I'm trying to get token with user and password as describe with ROPC <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth-ropc" rel="nofollow noreferrer">Microsoft identity platform and OAuth 2.0 Resource Owner Password Credentials</a>, use following API to test it with my corporate mail.</p>
  
  <pre><code>POST /{{TennatId}}/oauth2/v2.0/token HTTP/1.1
  Host: login.microsoftonline.com
  Content-Type: application/x-www-form-urlencoded
  SdkVersion: postman-graph/v1.0
  Content-Type: application/x-www-form-urlencoded
  
  grant_type=password&amp;client_id={{ClientId}}&amp;client_secret={{ClientSecret}}&amp;scope=https://graph.microsoft.com/onlineMeetings.ReadWrite&amp;userName=MyCorporateMail@org.com&amp;password=MyPassword
  </code></pre>
  
  <p>But, it will always get <strong>invalid_grant</strong> response: <em>AADSTS50126: Error validating credentials due to invalid username or password.</em>
  I don't know why it cannot get token response with my corporate(work) mail/account **@sap.com, I'm sure my password and other parameters are correct. </p>
  
  <p>And if I use a new-test-user <a href="http://sapse@wardsap.onmicrosoft.com" rel="nofollow noreferrer">sapse@wardsap.onmicrosoft.com</a> which is created by Azure Active Directory, I'll get token successfully. This user doesn't need Two-Step authentication when login to Azure. But this user does have Teams/OnlineMeeting license, so it couldn't generate onlineMeeting.</p>
  
  <p><strong>My Question</strong>:</p>
  
  <ol>
  <li><p>Will it possible caused by MFA configuration from my org? Because I noticed that every time I login to <a href="https://aad.portal.azure.com/" rel="nofollow noreferrer">https://aad.portal.azure.com/</a>, it has second authentication step, verify with my Phone message.
  If yes, will it be possible to disable MFA to some test/dev account forever? Where should we config it? Within MS Azure or some where else? Who should I get support from?</p></li>
  <li><p>For this <a href="https://docs.microsoft.com/en-us/graph/api/application-post-onlinemeetings?view=graph-rest-1.0&amp;tabs=http" rel="nofollow noreferrer">Create onlineMeeting</a> API, do we have other authentication flow for this Delegate permission type for a back-end daemon service?</p></li>
  </ol>
  
  <p>Thanks and Best Regards,
  Ward</p>