MC1188595 – M365 Change Digest

One-line summary

SharePoint Online Management Shell now supports App-Only Certificate-Based Authentication, enabling secure, unattended automation even with MFA enforced.

Similar updates

Details

Summary

SharePoint Online Management Shell now supports app-only certificate-based authentication for secure, unattended automation with MFA. Administrators can register apps in Microsoft Entra ID, assign API permissions, and use certificates to run scripts without user credentials, enhancing security and compliance.

Body (from Message Center)

[Introduction]

We are pleased to announce that SharePoint Online Management Shell now supports App-Only Certificate-Based Authentication. This update addresses the business need for secure, unattended automation in environments where (for example) Multi-Factor Authentication (MFA) is enforced. With this enhancement, customers can run automation scripts using app identities, ensuring compliance with security policies while maintaining operational efficiency.

[When this will happen:]

This feature is now generally available.

[How this affects your organization:]

Who is affected: SharePoint administrators and automation engineers using SharePoint Online Management Shell for scripting and automation.

What will happen:

Customers can now authenticate scripts using app identities registered in Microsoft Entra ID (formerly Azure AD), instead of user credentials.
This enables seamless execution of unattended scripts, even when MFA is enforced.
We expect most scenarios to work with App-Only authentication. However, there could be rare cases where an API needs an explicit user token for security reasons. In such cases, tenant admins should use interactive flows with admin/user credentials. Feel free to reach out to us if needed.

[What you can do to prepare:]

Follow these one-time steps to register your app and enable certificate-based authentication:

Step 1: Register the application in Microsoft Entra ID.
Step 2: Assign API permissions to the application:
- Tenant Admin APIs currently support App-Only access only if they have the Sites.FullControl scope.
- We are in the process of supporting more granular scopes for tenant APIs. For up-to-date information, refer to SharePoint Admin APIs Authentication and Authorization.
- You can assign permissions by:
  - Selecting and assigning API permissions from the portal.
  - Modifying the app manifest to assign API permissions (required for Microsoft 365 GCC High and DoD organizations).
- Learn more: Step 2: Assign API permissions to the application
Step 3: Generate a self-signed certificate or obtain one from a certificate authority.
Step 4: Attach the certificate to the Microsoft Entra application.

Once these steps are completed, update the Connect-SPOService line at the beginning of your scripts to use the app identity instead of user credentials. For examples, refer examples 7, 8, and 9 in this article: Connect-SPOService (Microsoft.Online.SharePoint.PowerShell).

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": null,
    "ai_actions": [
      "Register app in Entra ID",
      "Assign Sites.FullControl API permissions",
      "Generate and attach certificate",
      "Update scripts to use app identity"
    ],
    "ai_master_tags": [
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "SharePoint Online Management Shell now supports App-Only Certificate-Based Authentication, enabling secure, unattended automation even with MFA enforced.",
    "ai_topics": [
      "SharePoint",
      "Entra"
    ],
    "category": "stayInformed",
    "details_map": {
      "Summary": "SharePoint Online Management Shell now supports app-only certificate-based authentication for secure, unattended automation with MFA. Administrators can register apps in Microsoft Entra ID, assign API permissions, and use certificates to run scripts without user credentials, enhancing security and compliance."
    },
    "id": "MC1188595",
    "importance": 1,
    "is_major_change": false,
    "last_modified": "2025-11-21T00:14:52Z",
    "ms_products": [
      "SharePoint"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "SharePoint Online"
    ],
    "severity": "normal",
    "tags": [
      "Feature update",
      "Admin impact"
    ],
    "title": "App-only certificate-based authentication now available in SharePoint Online Management Shell"
  }
}