In a simple way, App Only authentication is the ideal method if you want to execute a task by daemon. This allows you to execute some code without the permissions of a user or without an auth token of a user.
As part of a series of articles, idea of this 1st post is to give you an basic fundamental understanding on creating an Azure AD App and grant permissions for this App to communicate with SPO.
let’s get this started. Simply head on to your Office365 home page and switch to Admin Centers. From the left pane, click on “Azure Active Directory”. From Azure AD, search for “App Registrations” and click “Add new application registration” link.
A new application interface will pop-up for you. Enter a name, Application type and Sign-on URL and click “Create”. Sign-in URL can be any and it also can be amended later to reflect a different one. A future post will discuss this again on what sort of URLs are used here.
Once the app creation done, you will be given with the app ID and other details related to it.
Next- Select Settings –> Required permissions and Add
In this case the API going to be SPO. You can choose the right API based on the requirement.
Next, hit “Grant Permission” button on the required permissions tab to provide none-tenant admin user access the application.
A self-signed or public (commercial) certificate must be provided now and then update the Azure AD manifest accordingly.
Following PS can be used to provision the certificate but ensure you have installed OfficeDev PnP PowerShell.
$certroot = 'C:\Site Creator'
$certname = "IntelAi-Cert-1"
$password = ConvertTo-SecureString "P@$$w0rd" -AsPlainText -Force
$startdate = Get-Date
$enddate = $startdate.AddYears(4)
makecert.exe -r -pe -n "CN=$certname" -b ($startdate.ToString("MM/dd/yyyy")) -e ($enddate.ToString("MM/dd/yyyy")) -ss my -len 2048
$cert = Get-ChildItem Cert:\CurrentUser\My | ? {$_.Subject -eq "CN=$certname"}
Export-Certificate -Type CERT -FilePath "$certroot\$certname.cer" -Cert $cert -Force
Export-PfxCertificate -FilePath "$certroot\$certname.pfx" -Cert $cert -Password $password -Force
Following line will copy a string to your clipboard
Get-PnPAzureADManifestKeyCredentials -CertPath 'C:\Site Creator\IntelAi-Cert-1.cer' | clip
Following is how the copied string would look like. It has to be added to the manifest file of the Azure AD application.
"keyCredentials": [
{
"customKeyIdentifier": "5lca+kziogw7T6MB4kUrxseK5m8=",
"keyId": "84153f1a-90b7-4802-b99a-bb75d4f9a35b",
"type": "AsymmetricX509Cert",
"usage": "Verify",
"value": "MIIDAjCCAe6gAwIBAgIQkawCJU0cWYxH8RamKNuqqTAJBgUrDgMCHQUAMBkx
}
],
Select your application under app registrations in Azure AD. Replace the “KeyCredentials”:[], section, as shown below.
Now this can be tested whether the application has required permissions to connect to the SharePoint Online site. For the ClientID, you need to provide application ID of the app you have created.
$password = ConvertTo-SecureString "P@$$w0rd" -AsPlainText -Force Connect-PnPOnline -Url https://site.sharepoint.com/ -ClientId 0c01f61e-ba27-4ae7-ab19-174884a949fc -CertificatePath 'C:\Site Creator\Site-Cert-1.pfx' -CertificatePassword $password -Tenant intelai.onmicrosoft.com $myWeb = Get-PnPWeb $myWeb.Title
DISCLAIMER NOTE: This is an enthusiast post and is not sponsored by Microsoft or any other vendor.
Microsoft Cloud Infrastructure Technical Journal 