Certificate-Based Authentication (CBA) is required to enable custom actions with SharePoint Online through the PnP PowerShell channel.
This method is required because Microsoft is retiring legacy IDCRL authentication in favor of modern authentication for SharePoint.
Prerequisites
- A Tenant Admin role is required.
- App management must already be configured.
- A certificate must be associated with App management. If this has not been completed yet, follow How to configure CBA in App management.
If a certificate has already been associated with App management, this step does not need to be repeated. The same certificate can also be used for How to migrate Exchange Online actions to CBA.
Configure SharePoint API permissions
Steps in this section are performed in the Microsoft Entra admin center.
Step 1: find the app registration
Copy the Client ID from the App management page.
Go to “App registrations” and paste the copied Client ID in the “All applications” search bar. Select the existing Microsoft Entra app registration used by App management. The PnP channel uses the same Client ID with certificate credentials.
Step 2: add the SharePoint permission
In the app registration, select “API permissions” > “Add a permission”.
Choose “SharePoint” from the “Request API permissions” list.
Select “Application permissions”, add Sites.FullControl.All, and click “Add permissions”.
Step 3: grant admin consent
Click “Grant admin consent for [your organization]”.
Additional permissions
Additional permissions may be required for specific scenarios.
| Use case | Required permission |
|---|---|
| Read or write site content | Sites.ReadWrite.All |
| Manage site collections | Sites.Manage.All |
Refer to Microsoft documentation for more information about Microsoft Graph permissions.
Confirm the certificate in App management
The certificate used for PnP SharePoint CBA must be associated with App management. If the certificate is not already uploaded, follow How to configure CBA in App management.
Behaviors and service notes
Authentication method
PnP SharePoint custom actions use certificate credentials associated with the App management app registration.
Certificate expiration
Certificates expire periodically and must be renewed before expiry. Certificate status can be verified in “App management”. A banner is displayed if the certificate is expired or misconfigured.
To renew the certificate, follow the renewal steps in How to configure CBA in App management.