Posted on

Service Principal (Application Authentication) [Certificate]

Overview

This guide demonstrates how to configure API permissions as well as certificate-based authentication for the [AzMSGraph] Application Service Principal to enable secure, non-interactive access to Microsoft Graph.

Next Steps: Establishing this authentication method is a prerequisite for our upcoming Logic Apps automation, which requires Microsoft Graph, SharePoint, and Microsoft 365 permissions to execute the new hire on-boarding pipeline.

Hybrid Worker Note: These steps apply directly to Hybrid Runbook Worker groups. However, admin can use a script to export the certificate from Azure Key Vault and import it into the on-premises machine’s local certificate store in order to properly use this method or import the certificate manually into the on premise server.

Prerequisite

On a machine with powershell 7 – Install PS module:

Install-Module -Name Microsoft.Graph.Authentication (use [Connect-MgGraph] to connect via certificate)

Install-Module -Name Microsoft.Graph.Users (Test scope post connect)

Import the modules with:

Import-module -Name Microsoft.Graph.Authentication
Import-Module -Name Microsoft.Graph.Users

Register Application [AzMSGraph]

In Microsoft Entra ID (formerly Azure AD), an App Registration is the process of telling Entra ID about your application so it can handle identity and access management. Think of it as creating a “digital identity” or “blueprint” for your app.

Why do you need it?

You register an app to:

Get a Client ID: A unique ID that identifies your app to Microsoft.

Enable Sign-in: Allow users to log in with their work, school, or personal Microsoft accounts.

Access APIs: Request permission to call services like Microsoft Graph (to read emails, calendars, etc.) or your own custom APIs.

Establish Trust: Create a "secret" or "certificate" so Entra ID knows it's really your app trying to talk to it.

Enable redirect URL

Assign API permissions [AzMSGraph]

1. App registration > API permission

2. API permissions > Select application permission (Do not use delegated permission to avoid passing credentials as user)

Required Permissions (*Grant Admin consent must be granted)

Microsoft Graph

User.ReadWrite.All (Application): Full administrative access to user accounts. Essential for your onboarding pipeline to provision accounts, set job titles, assign department attributes, or reset initial passwords.
Office 365 Exchange Online

Exchange.ManageAsAppV2 (Application)
Exchange.ManageAsApp (Application)

Enables unattended App-Only authentication to Exchange Online PowerShell (Connect-ExchangeOnline -CertificateThumbprint ...). This lets your pipeline automatically configure mailboxes, distribution list memberships, or email forwarding for new hires without requiring a traditional service account with a password.
Office 365 SharePoint Online

Sites.FullControl.All (Application): Grants the service principal administrative access across all SharePoint site collections in the tenant. This allows your onboarding scripts to automatically grant new hires access to team sites, create personal folder structures, or provision document libraries.

Verify: (There are other permission provided like device read/write, it is not necessary for this project but may be useful later on)

Set up authentication for app (AzMSGraph) (Certificate method)

In the Certificates & secrets section of [App Registration], you define the credentials your application uses to prove its identity to Microsoft. This is effectively the “password” for your application.

Certificates (The "Key")

Instead of a text string (Secret), you upload the public key (.cer, .pem, or .crt) of a certificate. Your application then uses its private key to sign an authentication request.

Best For: Production environments.

Pros: Much more secure than secrets. The private key never leaves your server (or Key Vault).

2026 Industry Change: Be aware that standard certificate validity is being shortened globally. Many public CAs now limit certificates to 398 days or less. Microsoft recommends rotating these every 180 days.

We decided to go with certificate-based authentication because it works reliably with our Hybrid Worker group. While Managed Identity is another popular approach, tracking down token failure issues with it can be a headache. Certificates have been rock-solid for this project and haven’t failed once and easy to implement.

Visual workflow to properly establish certificate authentication:

1. Create key vault (In Azure admin portal – https://portal.azure.com/auth/login/) [Az-KeyVault-Red929]

2. Generate a certificate from key vault [Az-KeyVault-Red929]:

Go to Azure Portal > Select Key Vault> Certificate > Generate

Certificate creation complete:

 3. Download the certificate in .CER format (Public Key) from the key vault

4. Upload the .CER file (Public Key) to application

Go back to Entra admin portal > app registration >  select app > upload the .CER file

Manual verification for CBA (Certificate Based Authentication)

The following steps shows how to manually import certificate in order to use for authentication

From on premise device:

Start with manual import of the PFX cert:
Test the cert by importing to computer and user personal directory. Test by importing only the PFX (Personal information exchange) /PEM (Privacy Enhanced Mail) certificate format. This cert is required to connect to the app successfully because it contains the Public and private Key. (Default password is blank)

Import it to certificate store per machine or per user.

Once the cert if imported, try to connect with the following commands:

Connect-MgGraph -ClientID “xxxxxxxxxxxxxxx” -TenantId “xxxxxxxxxxxxxxx” -CertificateThumbprint “xxxxxxxxxxxxxxx”

Troubleshoot

1. Cannot generate a certificate from key vault due to error message “The Operation is not allowed by RBAC”

2. ClientCertificateCredential authentication failed: The certificate certificate does not have a private key.

Import the certificate as a .pfx file and ensure “Mark this key as exportable” is checked, ensuring the private key is included (Import .CER format only imports it as public key)

Issue – Only the .CER format was installed on the computer. The CER. (x.509) cert does not contain the private key with it. Admin must import it as PFX format since it contains private key.

Source:

https://andrewstaylor.com/2024/03/04/getting-started-with-graph-and-azure-automation/

https://www.christianfrohn.dk/2022/04/23/connect-to-microsoft-graph-with-powershell-using-a-certificate-and-an-azure-service-principal/

https://blog.admindroid.com/connect-to-microsoft-graph-powershell-using-certificate/

Leave a comment