You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: microsoftgraph/docs-conceptual/app-only.md
+14-47Lines changed: 14 additions & 47 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,11 +2,11 @@
2
2
title: "Use app-only authentication with the Microsoft Graph PowerShell SDK"
3
3
description: "Learn how to use app-only authentication to enable non-interactive scenarios with the Microsoft Graph PowerShell SDK."
4
4
5
-
author: jasonjoh
5
+
author: msewaweru
6
6
manager: CelesteDG
7
7
ms.topic: conceptual
8
-
ms.date: 04/25/2023
9
-
ms.author: jasonjoh
8
+
ms.date: 09/08/2023
9
+
ms.author: eunicewaweru
10
10
---
11
11
12
12
# Use app-only authentication with the Microsoft Graph PowerShell SDK
@@ -29,54 +29,17 @@ Before you can use app-only access with the Microsoft Graph PowerShell SDK, make
29
29
1. Get the value of the certificate subject or its thumbprint.
30
30
-[Register an application](/azure/active-directory/develop/app-objects-and-service-principals) in Azure AD, configure it with the permission scopes your scenario requires, and share the public key for your certificate.
31
31
32
-
### Register the application
32
+
### Step 1: Register an application
33
33
34
-
You can register the application either in the [Azure Active Directory portal](https://aad.portal.azure.com), or using PowerShell.
35
-
36
-
<!-- markdownlint-disable MD025 -->
37
-
# [Portal](#tab/azure-portal)
38
-
39
-
1. Open a browser and navigate to the [Azure Active Directory admin center](https://aad.portal.azure.com) and sign in using a Microsoft 365 tenant organization admin.
40
-
41
-
1. Select **Azure Active Directory** in the left-hand navigation, then select **App registrations** under **Manage**.
42
-
43
-

44
-
45
-
1. Select **New registration**. On the **Register an application** page, set the values as follows.
46
-
47
-
- Set **Name** to `Graph PowerShell Script`.
48
-
- Set **Supported account types** to **Accounts in this organizational directory only**.
49
-
- Leave **Redirect URI** blank.
50
-
51
-

52
-
53
-
1. Select **Register**.
54
-
1. On the **Graph PowerShell Script** page, copy the values of the **Application (client) ID** and **Directory (tenant) ID** and save them.
55
-
56
-

57
-
58
-
1. Select **API Permissions** under **Manage**. Select **Add a permission**.
59
-
60
-
1. Select **Microsoft Graph** then select **Application Permissions**. Check **User.Read.All** and **Group.Read.All**, then select **Add permissions**.
61
-
62
-
1. In the **Configured permissions**, remove the delegated **User.Read** permission under **Microsoft Graph** by selecting the **...** to the right of the permission and selecting **Remove permission**. Select **Yes, remove** to confirm.
63
-
64
-
1. Select the **Grant admin consent for...** button, then select **Yes** to grant admin consent for the configured application permissions. The **Status** column in the **Configured permissions** table changes to **Granted for ...**.
65
-
66
-

67
-
68
-
1. Select **Certificates & secrets** under **Manage**. Select **Upload certificate** under **Certificates**. Browse to your certificate's public key file and select **Add**.
69
-
70
-
# [PowerShell](#tab/powershell)
71
-
<!-- markdownlint-enable MD025 -->
72
-
73
-
You may be wondering: "Can I use the PowerShell SDK to register an app, so that I can use the PowerShell SDK?" Yes! In this case, you're using the PowerShell SDK with delegated access, logging in as an administrator, and creating the app registration. Using that app registration, you can use the Microsoft Graph PowerShell SDK with app-only access, allowing for unattended scripts.
34
+
You can register an application using the PowerShell SDK with delegated access by signing in as an administrator, and creating the app registration.
74
35
75
36
1. Use a text editor to create a new file named **RegisterAppOnly.ps1**. Paste the following code into the file.
1. Save the file. Open PowerShell in the directory that contains **RegisterAppOnly.ps1** and run the following command.
40
+
1. Save the file. Open PowerShell in the directory that contains **RegisterAppOnly.ps1** and run the following command. If you don't already have a certificate, you can create a self-signed certificate using the [See also](#see-also) section.
Create a new file named **GraphAppOnly.ps1** and add the following code.
130
95
@@ -177,6 +142,8 @@ Mark 8 Project Team 2bf1b0d0-81f6-4e80-b971-d1db69f8d651
177
142
...
178
143
```
179
144
145
+
We've used app-only access to authenticate with Microsoft Graph and list users and groups in our tenant. You can use this same pattern to create scripts that perform any operation supported by the Microsoft Graph PowerShell SDK for non-interactive scenarios.
146
+
180
147
## See also
181
148
182
149
-[How to: Create a self-signed public certificate to authenticate your application](/azure/active-directory/develop/howto-create-self-signed-certificate).
0 commit comments