title: Obtaining a token for a Web API using user credentials
body: <p>I've created a new user account in my test AAD tenant, say <code>testuser1@mytenant.onmicrosoft.com</code> and set a password for it. This new account is a member of a security group that can access a specific Web API. I'm trying to write a test (a console program) that <em>non-interactively</em> obtains an access token using the user credentials and the app id as audience and then calls an endpoint.</p>
  
  <p>How do I do that?</p>
  
  <p><strong>Update</strong>:</p>
  
  <p>I'm trying to write a set of integration security tests for my Web API application. The application uses AAD groups it gets as a set of claims and treats them as roles. So I want a set of test user accounts with a known password with different roles to test behavior of an endpoint under different security contexts. The approach worked for me for years with classic AD (where I could impersonate a user using <em>login/password</em> pair and perform a SOAP call to a service with Windows Auth enabled). </p>
  
  <p><strong>Updated2:</strong></p>
  
  <p>I could use a set of app registrations instead of test user accounts and get a token without no problem using <em>client_id/client_secret</em> pair but assigning an enterprise application to a security group requires premium AAD tier which is very expensive :(</p>