Microsoft Entra IDPnP PowerShellCertificatesAutomation

Register an Entra ID App for PnP PowerShell Certificate Authentication

Use this guide to set up app-only authentication for SharePoint Online PowerShell automation. You will register an application, create or obtain a certificate, upload its public key to the app registration, grant the required API permissions, and test the connection.

Before you begin: You need permission to register applications in your tenant and an administrator who can approve the required application permissions. Use least privilege. The exact permissions depend on the commands your script runs.

1. Why use certificate authentication?

PnP PowerShell can authenticate as an Entra application rather than relying on a user signing in interactively. This is useful for scheduled reports and unattended administration. The application ID identifies the app; the certificate proves possession of its private key.

Tenant ID: identifies your Microsoft Entra tenant.
Client ID: identifies the app registration.
Public certificate (.cer): uploaded to the app registration.
Private certificate (.pfx): kept securely on the machine that runs the script.

Security: Never upload a PFX file, private key, or certificate password to GitHub. A public repository must never contain private credentials.

2. Register the application in Microsoft Entra ID

Open the Microsoft Entra admin center.
Navigate to Identity → Applications → App registrations and select New registration.
Enter a clear name, for example M365Buddy-SharePoint-Automation.
For an app used only in your organization, select Accounts in this organizational directory only (Single tenant).
Leave Redirect URI blank for this unattended app-only PowerShell scenario unless your specific solution requires one.
Select Register.
On the Overview page, copy the Application (client) ID and Directory (tenant) ID. Store these values in your secure configuration.

3. Create or obtain a certificate

For production automation, prefer a certificate issued by a trusted certificate authority and manage its lifecycle securely. A self-signed certificate can be useful for a controlled lab or test environment, subject to your organization's policy.

To create a certificate for testing, follow our companion guide:

Related M365Buddy guide:
Create a Self-Signed Certificate for Microsoft Entra App Authentication
This explains how to create a certificate with PowerShell, export the public .cer and private-key .pfx files, and protect the private key.

If you already have a certificate, make sure the private key is available to the account that will run PowerShell and that the certificate has not expired.

4. Upload the public certificate to the app

Open your app registration in the Entra admin center.
Select Certificates & secrets → Certificates.
Select Upload certificate.
Choose the public .cer file, add a description, and select Add.
Confirm that the certificate appears in the list and note its expiration date.

Upload the public certificate only. Keep the private-key PFX on the execution machine or in an approved secret/certificate store.

5. Configure the required API permissions

Permissions are determined by what the script actually does. A read-only inventory needs different access from a script that changes site settings or manages permissions.

Open API permissions in the app registration.
Select Add a permission.
Choose the API used by your script, such as SharePoint or Microsoft Graph, and select the required Application permissions for unattended app-only access.
Select only the permissions needed for the script's operations.
Have an authorized administrator select Grant admin consent if required by the permission type and tenant policy.
Confirm the permissions show as granted.

Important: Do not copy a broad permission list from another script without checking the commands used. Some PnP/SharePoint operations require SharePoint-specific application permissions or an explicit site grant. API permissions alone do not guarantee that every operation is authorized.

6. Test the PnP PowerShell connection

Install or update PnP PowerShell in PowerShell 7, then test the connection using your own tenant, client ID and certificate path.

Install-Module PnP.PowerShell -Scope CurrentUser

$Tenant   = "contoso.onmicrosoft.com"
$ClientId = "YOUR-APPLICATION-CLIENT-ID"
$AdminUrl = "https://contoso-admin.sharepoint.com"
$PfxPath  = "C:\Certificates\M365Buddy-SharePoint-Automation.pfx"

Connect-PnPOnline `
    -Url $AdminUrl `
    -Tenant $Tenant `
    -ClientId $ClientId `
    -CertificatePath $PfxPath

Get-PnPTenantSite -Limit 5

Use the tenant domain or tenant ID accepted by your installed PnP PowerShell version. If the PFX is password-protected, use the supported certificate-password parameter for your module version, and retrieve the password securely rather than hard-coding it in a script.

If connection succeeds but a command returns Access denied, check the API permissions, admin consent, site-specific grants where applicable, and whether the command supports app-only authentication.

7. Troubleshooting

Certificate or PFX cannot be read

Check that the path exists and the file is a valid PFX.
Confirm the PFX password is correct if one is required.
Ensure the Windows account running the script can access the file and private key.
Check certificate validity dates and that the corresponding public certificate is uploaded to the correct app registration.

Authentication works but commands fail

Confirm the app is registered in the intended tenant.
Confirm the client ID and tenant are paired correctly.
Review the exact API permissions and admin consent.
Check whether the cmdlet requires SharePoint administrator privileges or site-specific authorization.

8. Use Your App Credentials for SharePoint Online Automation

Once certificate authentication is configured and tested, you can reuse the same Entra ID app registration and certificate to connect to SharePoint Online from compatible PowerShell scripts.

Depending on the permissions granted to the application and the authorization required by each operation, this setup can support tasks such as:

Site inventory and reporting: Export site URLs, owners, storage usage and other site details. Start with SharePoint Online Site Inventory.
Version management: Report document version counts and review version limits. See SharePoint Version Management.
Storage reporting and governance: Understand capacity and identify storage-management opportunities. See SharePoint Storage Management.
Site lifecycle management: Support site inventory, ownership reviews and governance reporting. See Site Lifecycle Management.
Other approved administrative tasks: Reuse the authentication pattern in compatible PnP PowerShell scripts, provided the application has the permissions required for each operation.

Example: Connect to SharePoint Online

Connect-PnPOnline `
    -Url "https://yourtenant-admin.sharepoint.com" `
    -ClientId "YOUR-CLIENT-ID" `
    -Tenant "yourtenant.onmicrosoft.com" `
    -CertificatePath "C:\Certificates\YourCertificate.pfx" `
    -CertificatePassword (Read-Host "Enter certificate password" -AsSecureString)

Replace the example values with your tenant, application and certificate details. Use the appropriate SharePoint URL for the task you intend to perform.

Important: Authentication alone does not grant access to every administrative operation. The application must have the required API permissions and admin consent, and an operation may also require SharePoint administrator privileges or site-level authorization. Keep the private certificate and its password secure; never publish them in source code or upload them to a public repository.