Create Certificate for SharePoint List App-Only Authentication
To enable SharePoint List app-only authentication, you need to create a certificate, upload it to Azure portal, and obtain a private key.
To create a certificate…
Create an empty folder on your computer.
Create a TXT file in the folder.
Copy the PowerShell script from the Granting access via Azure AD App-Only page and paste it into the TXT file.
- Rename the TXT file to:
Run Windows PowerShell in the folder.
Go to the directory which contains the PS1 file. Otherwise, the next step will fail.
Copy the command:
.\Create-SelfSignedCertificate.ps1 -CommonName "myCertificate" -StartDate -StartDate 2022-09-25 -EndDate 2023-10-25The CommonName value in parenthesis is the name of the certificate which we’re creating. Enter a unique name for this value. Change the StartDate to the current date and the EndDate to a date of your choice.
Paste the copied command with your changes to Windows PowerShell and then press Enter.
Windows PowerShell will prompt Enter the password to protect Private Key.
Make sure you always remember the password as it is very important in later steps.
Windows PowerShell creates 2 files: MyCertificate.pfx and MyCertificate.cer.
To upload your certificate to Azure portal…
- Sign in to Azure Portal and register a new application with these parameters:
Name: Name of you choice.
Supported account types: Accounts in this organizational directory only (Account name only - Single tenant).
- Go to API Permissions > Add permission > Request API permissions > SharePoint.
- Select Application permissions and then add your required permissions.
- Select Grant admin consent and then select Yes.
- When you complete the previous steps, go to Certificates & Secrets. Don’t add Client Secrets in the app as it interferes with the certificate-based authentication flow.
- Select Upload Certificate and then upload your CER certificate from your computer. After the upload finishes, select Add.
- Go to Manifest, find KeyCredentials and then copy the customKeyIdentifier as the Thumbprint. You will use this later. You've now registered the app and linked the certificate.
To obtain a private key, convert the PFX file to a PEM file using OpenSSL.
- Run the Command Prompt.
- Go to the folder with your PFX file and run this command:
openssl pkcs12 -in MyCertificate.pfx -out MyCertificate.pem -nodes
Enter the PFX password which you used in step 8 of the certificate creation process.
Open the PEM file in Notepad and copy the private key including
-----BEGIN PRIVATE KEY-----to
-----END PRIVATE KEY-----
To finish the setup...
Copy the ClientID and TentantID from the newly registered app in the Azure portal.
Once you have all of these 4 credentials, you can sign in with SharePoint List Service Principal authentication.