New feature update – SharePoint Online Management Shell now supports app-only certificate-based authentication

Hi All,

Greetings for the day!!!

Today I am sharing feature update related to Microsoft SharePoint Online PowerShell.

Feature update:

• SharePoint Online Management Shell now supports App-Only Certificate-Based Authentication.
• SharePoint Online Management Shell now supports app-only certificate-based authentication for secure, unattended automation with MFA. 
• Administrators can register apps in Microsoft Entra ID. They can assign API permissions. Using certificates to run scripts without user credentials enhances security and compliance.
• This enables seamless execution of unattended scripts, even when MFA is enforced.

Connect-SPOService
    -Url <UrlCmdletPipeBind>
    -ClientId <String>
    -TenantId <String>
    [-ClientTag <String>]
    [-Region <AADCrossTenantAuthenticationLocation>]
    [-AuthenticationUrl <String>]
    [-Certificate <X509Certificate2>]
    [-CertificatePath <String>]
    [-CertificateThumbprint <String>]
    [-CertificatePassword <SecureString>]
    [<CommonParameters>]

Examples:

Connect to the SharePoint Online service using an app identity and a certificate file path, with an optional password.

$password = Read-Host -Prompt "Enter certificate password" -AsSecureString

Connect-SPOService -Url https://knowledgejunction1.sharepoint.com -ClientId 00000000-0000-0000-0000-000000000000 -Tenant 11111111-1111-1111-1111-111111111111 -CertificatePath C:\Certs\KJAppAuth.pfx -CertificatePassword $password

Connect to the SharePoint Online service using an app identity and a certificate thumbprint.

Connect-SPOService -Url https://knowledgejunction1.sharepoint.com -ClientId 00000000-0000-0000-0000-000000000000 -Tenant 11111111-1111-1111-1111-111111111111 -CertificateThumbprint "3FAAAA1111AAAAAAAAAAA2222AAAAAAAAAAAAAAA"

Connect to the SharePoint Online service using an app identity and a certificate object.

$thumbprint = "3F2A5C9D4E7B8A1234567890ABCDEF1234567890"

$cert = Get-ChildItem Cert:\LocalMachine\My\$thumbprint

Connect-SPOService -Url https://knowledgejunction1.sharepoint.com -ClientId 00000000-0000-0000-0000-000000000000 -Tenant 11111111-1111-1111-1111-111111111111 -Certificate $cert

REFERENCES

• App-only authentication for unattended scripts in Exchange Online PowerShell and Security & Compliance PowerShell
• Connect-SPOService
• Small Tips and Tricks – Microsoft Entra admin center – How to navigate – Microsoft Entra admin center – https://knowledge-junction.in/2022/12/19/small-tips-and-tricks-microsoft-entra-admin-center-how-to-navigate-microsoft-entra-admin-center/
• Exploring Microsoft Entra – How to restrict users from registering an application
• Microsoft Entra ID admin center – https://entra.microsoft.com/
• Microsoft Entra – registering new application and assigning permissions to access Microsoft Graph APIs – https://knowledge-junction.in/2024/01/18/microsoft-entra-registering-new-application-and-assigning-permissions-to-access-microsoft-graph-apis/