How to configure Certificate-Based Authentication in App management

Certificate-Based Authentication (CBA) can be configured in App management and reused by supported workloads, including Exchange Online management actions and PnP SharePoint custom actions.

This configuration uses the existing Microsoft Entra app registration associated with App management. The public certificate is uploaded in Microsoft Entra, while the private key is uploaded in App management.

Prerequisites

• Create or retrieve the certificate files:
  • The public certificate (.cer).
  • The private key (.pfx), optionally protected by a password.
    • If the .pfx file is password-protected, enter the password in App management. Otherwise, leave the field blank.
• A Tenant Admin role is required.
• App management must already be configured.

Upload the public certificate in Microsoft Entra

Steps in this section are performed in the Microsoft Entra admin center.

Step 1: find the app registration

Copy the Client ID from the App management page.

Go to “App registrations” and paste the copied Client ID in the “All applications” search bar. Select the existing Microsoft Entra app registration used by App management.

Step 2: upload the certificate

Open the app registration, then go to “Certificates & secrets” > “Certificates”.

Click “Upload certificate”, select the .cer file containing the public key, and click “Add”.

Upload the private key in App management

Steps in this section are performed in the app.

1. Open “Settings” > “My organization” > “App management”.
2. In the “Certificate” section, click “Upload”.
3. Select the .pfx file containing the private key for the certificate.

4. A password prompt is displayed. If the certificate does not have a password, leave the field blank and click “Next”.

5. After the certificate is uploaded, it appears with its expiration date and a button to replace it.

Certificate renewal

Certificates expire periodically and must be renewed before expiry. Certificate status can be verified in “App management”. A banner is displayed if the certificate is expired or misconfigured.

Before the certificate expires:

1. Upload the new .cer file in Microsoft Entra > App registrations.
2. In “App management” > “Certificate”, click “Replace”.
3. Upload the new .pfx file.

How to generate certificates

Use a certificate generation method that matches the organization’s security practices. The following methods are examples; other methods are also possible.

PowerShell

See Microsoft’s guide to creating a self-signed certificate.

Azure Key Vault

• Navigate to the Azure Key Vault resource.
• Select “Objects” > “Certificates” > “Generate/Import”.
• Select the method, certificate name, and certificate type: self-signed or CA-signed.
• Use a recommended validity of 12–24 months.
• Select PKCS #12 as the content type.