How to connect Microsoft Graph PowerShell with Certificate
Microsoft Graph is a powerful platform that provides access to Microsoft 365 data and services, such as Outlook, OneDrive, Teams and many others. Using Microsoft Graph PowerShell allows you to automate and manage these services via scripts. A secure method of authenticating in Microsoft Graph PowerShell is via a certificate. This guide explains the steps required to set up and use a certificate to connect to Microsoft Graph PowerShell.
Prerequisites
- Microsoft 365 Subscription: Make sure you have an account with a valid subscription.
- Azure Active Directory:The certificate must be associated with an application registered in Azure AD.
- PowerShell: Install the module
Microsoft.Graphto use Microsoft Graph PowerShell cmdlets.
Step 1: Generate and Configure a Certificate
You can create a certificate using various tools, such as OpenSSL or PowerShell commands. The following shows how to create one with PowerShell.
For this guide we will create an adhoc one with the help of this script: Create-SelfSignedCertificate.ps1
On the Windows Server, download the script.
Open a powershell as administrator, locate the share where the script is located and run the following command:
.\Create-SelfSignedCertificate.ps1 -CommonName "MyCert" -StartDate 2015-11-21 -EndDate 2017-11-21
Changing the name of the certificate and the start and end date.
The certificate will automatically be exported to the folder where the script is located.
Step 2: Create and Register an Application in Azure AD
Go to https:\\entra.microsoft.com and go to App Registration
Click on New Registration
Fill in the name and press Register
Once the application has been created, please note that in the Overview screen, Application ID and Tenat ID will be needed later.
Go to the Certificates & Secrets section.
Upload the previously created certificate (Public Part – .cer)
Step 3: Assign API Permissions
- On your registered application page, go to API Permissions > Add a permission.
- Select the API required for your application, such as Microsoft Graph.
- Grant administrative permissions if necessary.
Step 4: Importing the Certificate on the Server
Go to the Windows server where you want to deposit the backup
Press the start key, launch run.exe and type certmgr.msc
Right-click on Personal, all tasks and click on Import
Click Next
Click Browse
Importing the private key
Click Next
Enter the certificate password
Place it in the Personal folder
Click Finish
Now in Trusted Root Certification Authorities, right click, All Task, Import
Click Next
Click Browse
Import the .cer
Click Next
Click Next
Click Finish
Step 5: Install and Configure Microsoft Graph PowerShell
Make sure you have the Microsoft.Graph module installed.
To install the module, open Powershell and run the following script with administrative rights
#Checking for correct modules and installing them if needed
$InstalledModules = Get-InstalledModule
$Module_Name = "Microsoft.Graph"
If ($InstalledModules.name -notcontains $Module_Name) {
Write-Host "Installing module $Module_Name"
Install-Module $Module_Name -Verbose -Force -AllowClobber
}
Else {
Write-Host "$Module_Name Module already installed"
}
Step 6: Authentication with the Certificate
Use the following script to authenticate in Microsoft Graph PowerShell using the certificate:
#Importing Module Write-Host "Importing Module Microsoft.Graph" Import-Module Microsoft.Graph # Connect to Microsoft Graph $tenant = "xxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" $clientId = "xxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" $Thumbprint = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" Connect-MgGraph -TenantId $tenant -ClientId $clientId -CertificateThumbprint $Thumbprint
Variables should be compiled in this way:
$tenant: Enter the Tenant ID of the created app registration
$clientId: Enter the Client ID of the app registration created
$Thumbprint: Enter the Thumprint of the imported certificate
Step 7: Check the Connection
Once the script is executed, you will receive the Microsoft Graph:
Remember to disconnect Microsoft Graph at the end of operations with the command Disconnect-MgGraph.
Conclusion
Authenticating in Microsoft Graph PowerShell using a certificate is a secure method that eliminates the need to manage credentials manually. By following these steps, you can quickly set up an Azure AD application, generate a certificate, and use it to authenticate and manage Microsoft 365 services in an automated way.
