Skip SharePoint Login from PowerShell to SharePoint
Online
A PowerShell with SharePoint tutorial
Once
a PowerShell script has been created, it can - and should!
- be reused in multiple sites. That way, PowerShell makes
SharePoint management efficient and less prone to errors.
When you work with PowerShell this way, it is convenient
to skip the SharePoint Online authentication. This is possible
if you have a certificate on your computer that allows SharePoint
modifications. In the demo below, Peter Kalmström shows
how to create such a certificate and get it registered.
Note that the registration and permission giving parts of
the process must be performed by someone who has access
to the Microsoft Entra admin center. Everyone involved should
also be aware of the security risks involved in skipping
the authentication.
The certificate has two files a .pfx file and a .cer file.
The .cer file only has the public key, while the .pfx has
both the public and the private key for the certificate.
The first step is to create a folder for the certificate
files on your computer. Peter gives it the name Cert. After
that, the process continues in VS Code and Microsoft Entra.
VS Code
The certificate files are created in VS Code, with a cmdlet.
In VS Code, enter the cmdlet New-PnPAzureCertificate.
Add the parameter CommonName and any name that you
make up. Peter uses the name kPnP.
Add the parameter Outpfx to say where the .pfx file
should be stored, and give the path to your certification
folder.
Add the parameter Outcert to say where the .cer
file should be stored, and give the path to your certification
folder.
Run the script row, to create the files. Do NOT
clear the Terminal when it fills up with certificate
data.
Microsoft Entra
When the certificate files have been created, the certificate
must be registered in Microsoft Entra.
In Entra >Applications >App registrations >New
Registration, enter the CommonName you gave the certificate
and click on Register. A new page will open.
Open the API permissions from the left menu and
click on + Add a permission.
Click on the SharePoint tile to give the certificate
permission to modify SharePoint.
Select the suitable permission levels and click
on Add permissions.
Click on Grant permission and then on Yes in the
dialog that opens.
Open Certificates & secrets from the left menu.
Under the Certificates tab, upload the .cer file
from your computer.
Local Certificate Folder
The .pfx file needs to be installed into the Certificate
Store on the computer you are running the scripts from.
Right-click on the file, select Install PFX and make the
choices you prefer.
VS Code
Now it is time to connect to SharePoint with the new certificate.
In the certificate code in the VS Code Terminal,
find the Thumbprint and copy it.
Create a Connect-PnPOnline command like this: Connect-PnPOnline
+ URL to the SharePoint site + the Application Client
ID for the certificate (which you can find in Entra)
+ the Thumbprint + The Tenant.
In the
next article, we will see how apps can be created and
removed with PowerShell code. Later we will expand this
code to give a possibility to create multiple apps with
different names in just one script run.
