Create Certificate for SharePoint List App-Only Authentication

Create an empty folder on your computer.

Create a text file in the folder.

Copy the PowerShell script from the Granting access via Azure AD App-Only page and paste it into the text file.

Rename the text file to:

Create-SelfSignedCertificate.ps1

Run Windows PowerShell in the folder.

Go to the directory which contains the text file. Otherwise, the next step will fail.

Copy the command:

.\Create-SelfSignedCertificate.ps1 -CommonName "myCertificate" -StartDate 2022-09-25 -EndDate 2023-10-25

The CommonName value in quotes is the name of the certificate which we’re creating. Enter a unique name for this value. Change the StartDate to the current date and the EndDate to a date of your choice.

Paste the copied command with your changes to Windows PowerShell and then press Enter.

Windows PowerShell will prompt Enter the password to protect Private Key.

Make sure you always remember the password as it is very important in later steps.

Windows PowerShell creates 2 files: MyCertificate.pfx and MyCertificate.cer.

Sign in to Azure Portal and register a new application with these parameters:

Name: Name of you choice.

Supported account types: Accounts in this organizational directory only (Account name only - Single tenant).

Go to API Permissions > Add permission > Request API permissions > SharePoint.

Select Application permissions and then add your required permissions.

Select Grant admin consent and then select Yes.

When you complete the previous steps, go to Certificates & Secrets. Don’t add Client Secrets in the app as it interferes with the certificate-based authentication flow.

Select Upload Certificate and then upload your CER certificate from your computer. After the upload finishes, select Add.

Go to Manifest, find KeyCredentials and then copy the customKeyIdentifier as the Thumbprint. You will use this later. You've now registered the app and linked the certificate.

Run the Command Prompt.

Go to the folder with your PFX file and run this command:

openssl pkcs12 -in MyCertificate.pfx -out MyCertificate.pem -nodes

Enter the PFX password which you used in step 8 of the certificate creation process.

Open the PEM file in Notepad and copy the private key including

-----BEGIN PRIVATE KEY-----

to

-----END PRIVATE KEY-----

Copy the ClientID and TentantID from the newly registered app in the Azure portal.

Once you have all of these 4 credentials, you can sign in with SharePoint List Service Principal authentication.

1. Client ID

2. Tenant ID

3. Thumbprint

4. Private key