Applications defined in Azure AD are allowed to make app-only calls by sharing a certificate with Azure AD. Azure AD will get the public key certificate and the app will get the private key certificate. Although a trusted certificate should be used for production deployments, cmdlet New-SelfSignedCertificate certificates are fine for testing/debugging (similar to local web debugging with https). Here are the steps to generate a self-signed certificate with cmdlet New-SelfSignedCertificate and exporting it for use with Azure AD.

Part 1: Generate a Self-signed Certificate

  1. Open Windows PowerShell ISE.

  2. Create a PowerShell script with the following content:

     $cert = New-SelfSignedCertificate -DnsName -CertStoreLocation "cert:\LocalMachine\My" -KeyLength 2048 -KeySpec "KeyExchange" -NotBefore 10/15/2019 -NotAfter 10/15/2021 
     = ConvertTo-SecureString -String "mySecurePassword" -Force -AsPlainText
     -Cert $cert -FilePath ".\" -Password $password
     -Type CERT -Cert $cert -FilePath .\
  3. Update the value for -DnsName.
  4. Update the values for -NotBefore and -NotAfter .
  5. Update the password value.
  6. Update the -FilePath value for the cer and pfx files.
  7. Additional information about these parameters can be found in the New-SelfSignedCertificate page.
  8. Execute the PowerShell script. You need administrator permissions to successfully execute the script.
  9. Both files should be created in the specified location.

Part 2: Create the Azure AD Application

  1. Log into the Azure Management Portal for your Office 365 tenant.
  2. Go to the Azure Active Directory tab and select App Registrations.
  3. Select "New Registration".
  4. On "Supported account types" select "Accounts in this organizational directory only ".
  5. On "Redirect URI" select Web.
  6. Enter a Sign-on URL (the value of this doesn’t really matter other than being unique) and click "Register".
  7. Look for your new application on the Registered Applications list and click it.
  8. Go to API Permissions and click on "Add a permission".
  9. On the "Select an API" section, add the "SharePoint" application
  10. Select "Application Permissions" and check the following permissions:
    1. TermStore.Read.All: Read Managed Metadata.
    2. Sites.FullControl.All: Have Full Control of all Site Collections.
    3. Sites.Read.All: Read Items in all Site Collections.
  11. Click on "Add permissions".
  12. After saving you have to click "Grant admin consent" to apply the changes.
On the Configure section you'll also see the Application ID. Copy and save this ID, you are going to need it when configuring the connector.

Part 3: Configure certificate public key for App

  1. Go to "Certificates and secrets".
  2. Click on "Upload certificate".
  3. Select the certificate created on Part 1.
  4. Add the certificate.

Part 4: Generate Private Key

You may need to download OpenSSL for Windows to follow these steps.
  1. Extract pem key

    openssl pkcs12 -nocerts -in <PFX Path> -out <PEM Path>
  2. Convert extracted pem key to der format

    openssl pkcs8 -topk8 -inform PEM -outform DER -in <PEM Path> -out <DER Path> -nocrypt

  • No labels