You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/sp-add-ins/replace-an-expiring-client-secret-in-a-sharepoint-add-in.md
+23-20Lines changed: 23 additions & 20 deletions
Original file line number
Diff line number
Diff line change
@@ -8,16 +8,16 @@ ms.localizationpriority: high
8
8
9
9
# Replace an expiring client secret in a SharePoint Add-in
10
10
11
-
Client secrets for SharePoint Add-ins that are registered by using the AppRegNew.aspx page expire after one year. This article explains how to add a new secret for the add-in, and how to create a new client secret that is valid for a customized date.
11
+
Client secrets for SharePoint Add-ins that are registered by using the **AppRegNew.aspx** page expire after one year. This article explains how to add a new secret for the add-in, and how to create a new client secret that is valid for a customized date.
12
12
13
13
> [!NOTE]
14
-
> This article is about SharePoint Add-ins that are distributed through an organization catalog and registered with the AppRegNew.aspx page. If the add-in is registered on the Seller Dashboard, see [Create or update client IDs and secrets in the Seller Dashboard](/office/dev/store/create-or-update-client-ids-and-secrets).
14
+
> This article is about SharePoint Add-ins that are distributed through an organization catalog and registered with the **AppRegNew.aspx** page. If the add-in is registered on the Seller Dashboard, see [Create or update client IDs and secrets in the Seller Dashboard](/office/dev/store/create-or-update-client-ids-and-secrets).
15
15
16
16
## Recommended maintenance schedule
17
17
18
-
We recommend to create new secrets a minimum of 30 days before they expire. This gives you a month of time before the old credentials expire.
18
+
We recommend creating new secrets a minimum of 30 days before they expire. This gives you a month of time before the old credentials expire.
19
19
20
-
We recommend to only remove secrets a minimum of 7 days after expiration, provided you have removed them from the application configuration.
20
+
We recommend only removing secrets a minimum of 7 days after expiration, provided you have removed them from the application configuration.
21
21
22
22
Removing an expired secret from ACS before you remove it from the application configuration will cause errors.
23
23
@@ -26,28 +26,30 @@ Removing an expired secret from ACS before you remove it from the application co
26
26
Ensure the following before you begin:
27
27
28
28
- You have installed Microsoft Graph Powershell SDK: [Install the Microsoft Graph PowerShell SDK](/powershell/microsoftgraph/installation)
29
-
- You're a tenant administrator (or having `Application.ReadWrite.All` permission) for the Office 365 tenant where the add-in was registered with the AppRegNew.aspx page.
29
+
- You're a tenant administrator (or having `Application.ReadWrite.All` permission) for the Microsoft 365 tenant where the add-in was registered with the **AppRegNew.aspx** page.
30
30
31
31
## Generate a new secret
32
32
33
-
1. Create a client ID variable with the following line, using the client ID of the SharePoint Add-in as the parameter.
33
+
1. Create a client ID variable with the following line, using the client ID of the SharePoint Add-in as the parameter:
34
34
35
35
```powershell
36
36
$clientId = 'client id of the add-in'
37
37
```
38
-
2. Connect to graph with `Application.ReadWrite.All` scope.
38
+
1. Connect to graph with **Application.ReadWrite.All** scope:
39
39
40
40
```powershell
41
-
Connect-MgGraph -Scopes "Application.ReadWrite.All" # Login with corresponding scope. Should be tenant admin or anyone have the permission.
# login with the corresponding scope; this user should be a tenant admin or anyone granted this permission
42
43
```
43
-
3. Generate a new client secret with the following lines:
44
+
45
+
1. Generate a new client secret with the following lines:
44
46
45
47
```powershell
46
48
$appPrincipal = Get-MgServicePrincipal -Filter "AppId eq '$clientId'" # Get principal id by AppId
47
49
48
50
$params = @{
49
51
PasswordCredential = @{
50
-
DisplayName = "NewSecret" # Replace with a firendly name.
52
+
DisplayName = "NewSecret" # Replace with a friendly name.
51
53
}
52
54
}
53
55
@@ -57,10 +59,11 @@ Ensure the following before you begin:
57
59
$result.EndDateTime # Print the end date.
58
60
```
59
61
60
-
4. The new client secret appears on the Windows PowerShell console. Copy it to a text file. You use it in the next procedure.
62
+
1. The new client secret appears on the Windows PowerShell console. Copy it to a text file. You use it in the next procedure.
61
63
62
64
> [!TIP]
63
-
> By default, the secret lasts two years if you didn't specifiy the EndDateTime. You can customize by leveraging the example below to specify the EndDateTime.
65
+
> By default, the secret lasts two years if you didn't specify the EndDateTime. You can customize by leveraging the example below to specify the EndDateTime.
66
+
>
64
67
> ``` powershell
65
68
> $params = @{
66
69
> PasswordCredential = @{
@@ -73,28 +76,28 @@ Ensure the following before you begin:
73
76
## Update the remote web application in Visual Studio to use the new secret
74
77
75
78
> [!IMPORTANT]
76
-
> If your add-in was originally created with a pre-release version of the Microsoft Office Developer Tools for Visual Studio, it may contain an out-of-date version of the TokenHelper.cs (or .vb) file. If the file does not contain the string "secondaryClientSecret", it is out of date and must be replaced before you can update the web application with a new secret. To obtain a copy of a release version of the file, you need Visual Studio 2012 or later. Create a new SharePoint Add-in project in Visual Studio. Copy the TokenHelper file from it to the web application project of your SharePoint Add-in.
79
+
> If your add-in was originally created with a pre-release version of the Microsoft Office Developer Tools for Visual Studio, it may contain an out-of-date version of the **TokenHelper.[cs|vb]** file. If the file does not contain the string `secondaryClientSecret`, it is out of date and must be replaced before you can update the web application with a new secret. To obtain a copy of a release version of the file, you need Visual Studio 2012 or later. Create a new SharePoint Add-in project in Visual Studio. Copy the **TokenHelper.[cs|vb]** file from it to the web application project of your SharePoint Add-in.
77
80
78
-
1. Open the SharePoint Add-in project in Visual Studio, and open the web.config file for the web application project. In the **appSettings** section, there are keys for the client ID and client secret. The following is an example:
81
+
1. Open the SharePoint Add-in project in Visual Studio, and open the **web.config** file for the web application project. In the `appSettings` section, there are keys for the client ID and client secret. The following is an example:
79
82
80
83
```XML
81
84
<appSettings>
82
85
<add key="ClientId" value="your client id here" />
83
86
<add key="ClientSecret" value="your old secret here" />
84
-
... other settings may be here ...
87
+
... other settings may be here ...
85
88
</appSettings>
86
89
```
87
90
88
-
1. Change the name of the **ClientSecret** key to `SecondaryClientSecret` as shown in the following example:
91
+
1. Change the name of the `ClientSecret` key to `SecondaryClientSecret` as shown in the following example:
89
92
90
93
```XML
91
94
<add key="SecondaryClientSecret" value="your old secret here" />
92
95
```
93
96
94
97
> [!NOTE]
95
-
> If you are performing this procedure for the first time, there is no **SecondaryClientSecret** property entry at this point in the configuration file. However, if you are performing the procedure for a subsequent client secret expiration (second or third), the property **SecondaryClientSecret** is already present and contains the initial or already expired old secret. In this case, delete the **SecondaryClientSecret** property first before renaming **ClientSecret**.
98
+
> If you are performing this procedure for the first time, there is no `SecondaryClientSecret` property entry at this point in the configuration file. However, if you are performing the procedure for a subsequent client secret expiration (second or third), the property `SecondaryClientSecret` is already present and contains the initial or already expired old secret. In this case, delete the `SecondaryClientSecret` property first before renaming `ClientSecret`.
96
99
97
-
1. Add a new **ClientSecret** key and give it your new client secret. Your markup should now look like the following:
100
+
1. Add a new `ClientSecret` key and give it your new client secret. Your markup should now look like the following:
98
101
99
102
```XML
100
103
<appSettings>
@@ -106,9 +109,9 @@ Ensure the following before you begin:
106
109
```
107
110
108
111
> [!IMPORTANT]
109
-
> You will not be able to use the newly generated client secret until the current client secret expires. Therefore, changing the ClientId key to the new client secret without the SecondaryClientSecret key present will not work. You must follow the procedure in this article and wait for the previous client secret to expire. You can then remove the SecondaryClientSecret if you want to.
112
+
> You will not be able to use the newly generated client secret until the current client secret expires. Therefore, changing the `ClientId` key to the new client secret without the `SecondaryClientSecret` key present will not work. You must follow the procedure in this article and wait for the previous client secret to expire. You can then remove the SecondaryClientSecret if you want to.
110
113
111
-
1. If you changed to a new TokenHelper file, rebuild the project.
114
+
1. If you changed to a new **TokenHelper.[cs|vb]** file, rebuild the project.
0 commit comments