Microsoft Entra IDPowerShellCertificates

Create a Self-Signed Certificate for Microsoft Entra App Authentication

This guide creates a certificate for a development or controlled test setup, exports the public certificate for upload to a Microsoft Entra app registration, and exports a PFX containing the private key for the machine that runs PnP PowerShell.

Production guidance: Microsoft recommends a certificate issued by a trusted certificate authority for production. A self-signed certificate is best kept for development/testing unless your security team explicitly approves it. Protect the PFX and its password as credentials.

1. What you need

Windows PowerShell with permission to create a certificate in your user certificate store.
An Entra app registration that will use the certificate.
A secure folder to store the PFX file.
Permission to upload the public certificate to the app registration.

2. Create the certificate

Open PowerShell and run the command below. It creates the certificate in the current Windows user's certificate store. The signature key and exportable private key settings are included in the command because the certificate will be used for app authentication and exported to a PFX file.

$cert = New-SelfSignedCertificate `
  -Subject "CN=M365Buddy-SharePoint-Automation" `
  -CertStoreLocation "Cert:\CurrentUser\My" `
  -KeyExportPolicy Exportable `
  -KeySpec Signature `
  -KeyLength 2048 `
  -KeyAlgorithm RSA `
  -HashAlgorithm SHA256 `
  -NotAfter (Get-Date).AddYears(1)

$cert | Select-Object Subject, Thumbprint, NotBefore, NotAfter

Example output (values will differ on your computer)Subject Thumbprint NotBefore NotAfter ------- ---------- --------- -------- CN=M365Buddy-SharePoint-Automation A1B2C3D4... 10/13/2026 10/13/2027

Keep the thumbprint and expiration date for your certificate inventory. Do not create a long-lived certificate without a rotation plan.

3. Export the public certificate (.cer)

The public certificate is uploaded to your Microsoft Entra app registration. It does not contain the private key. The example saves it in your Documents folder; change $CerPath to any folder you prefer, as long as that folder already exists and you have permission to write to it.

$CerPath = "$env:USERPROFILE\Documents\M365Buddy-SharePoint-Automation.cer"

Export-Certificate -Cert $cert -FilePath $CerPath

Write-Host "Public certificate: $CerPath"

Expected resultPath ---- C:\Users\<your-user>\Documents\M365Buddy-SharePoint-Automation.cer

4. Export the private certificate (.pfx)

The PFX includes the private key and must be protected. Use a strong password and store the file in a restricted folder accessible only to the intended automation identity. You can change $PfxPath to a different folder or filename. Make sure the destination folder already exists and that the account running PowerShell can access it.

$PfxPath = "$env:USERPROFILE\Documents\M365Buddy-SharePoint-Automation.pfx"
$PfxPassword = Read-Host "Enter a strong PFX password" -AsSecureString

Export-PfxCertificate `
  -Cert $cert `
  -FilePath $PfxPath `
  -Password $PfxPassword

Write-Host "Private-key PFX: $PfxPath"

Expected resultPath ---- C:\Users\<your-user>\Documents\M365Buddy-SharePoint-Automation.pfx

Never commit the .pfx file or its password to GitHub. If you accidentally expose a private key, remove the credential from use, replace it, and follow your organization's incident process.

5. Upload the .cer to Microsoft Entra

Open Microsoft Entra admin center.
Go to App registrations and select your automation app.
Select Certificates & secrets → Certificates.
Select Upload certificate, choose the .cer file, provide a description and add it.
Confirm the certificate thumbprint and expiry date are shown.

6. Use the PFX with PnP PowerShell

Use the tenant and client ID from your app registration. Update -CertificatePath to match the location where you saved the PFX file. If you change the path during export, use that same path here.

Connect-PnPOnline `
  -Url "https://contoso-admin.sharepoint.com" `
  -Tenant "contoso.onmicrosoft.com" `
  -ClientId "YOUR-APPLICATION-CLIENT-ID" `
  -CertificatePath "$env:USERPROFILE\Documents\M365Buddy-SharePoint-Automation.pfx"

Successful connectionConnect-PnPOnline normally returns no success message. Verify the connection with a harmless command such as Get-PnPWeb and confirm that the expected site title and URL are returned.

Get-PnPWeb | Select-Object Title, Url

Example output (your site details will differ)Title Url ----- --- Communication Site https://contoso.sharepoint.com/sites/CommunicationSite

Replace the example tenant, client ID and URL with your organization's values. If the PFX is password-protected, use the certificate-password option supported by your installed PnP PowerShell version and retrieve the password securely. Never hard-code it in the script.

7. Verify and maintain the certificate

Confirm the app registration has the correct public certificate.
Confirm the private key is present and readable by the intended execution account.
Test authentication before running the full report.
Monitor expiry and replace the certificate before it expires. Upload the new public certificate and test it before removing the old one.
Remove unused certificates from the app and securely delete obsolete private-key copies according to policy.

Next steps

Continue setup: Register an Entra ID App for PnP PowerShell Certificate Authentication explains app registration, permissions, admin consent and testing.

Use the configuration: Export All SharePoint Online Sites Using PnP PowerShell.