Application Credentials with Certificate (Sign JWT with Private Key)

Instructions

This guide walks you through setting up a certificate-based authentication flow for Microsoft Graph or other Azure AD protected APIs using client credentials and a JWT.

Step 1: Generate a Self-Signed Certificate

# Run this in PowerShell
#Change .AddYears(1) to desired number. By default it expires certificate in one year as per below code.

$cert = New-SelfSignedCertificate `
  -Subject "CN=MyClientAppCert" `
  -KeySpec Signature `
  -KeyExportPolicy Exportable `
  -KeyLength 2048 `
  -CertStoreLocation "Cert:\CurrentUser\My" `
  -KeyAlgorithm RSA `
  -HashAlgorithm SHA256 `
  -NotAfter (Get-Date).AddYears(1) `
  -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider"

# Export private key (.pfx)  - Keep this with you to make API calls (SECRET KEY - DONOT SHARE)
$pfxPath = "$env:USERPROFILE\Desktop\private_key.pfx"
$pwd = ConvertTo-SecureString -String "yourStrongPassword123" -Force -AsPlainText
Export-PfxCertificate -Cert $cert -FilePath $pfxPath -Password $pwd

# Export public certificate (.cer) - UPLOAD this to Azure Portal
$cerPath = "$env:USERPROFILE\Desktop\public_key.cer"
Export-Certificate -Cert $cert -FilePath $cerPath

Step 2: Register or Configure an App in Azure AD

1. Go to https://portal.azure.com
2. Navigate to Azure Active Directory > App registrations
3. Click + New registration or open an existing app
4. Copy the Application (client) ID and Directory (tenant) ID

Step 3: Upload the Certificate

1. In your App Registration, go to Certificates & secrets
2. Under Certificates, click Upload certificate
3. Select the .cer file (public certificate)
4. Click Add

Step 4: Grant API Permissions

1. Go to the API permissions tab
2. Click Add a permission
3. Select Microsoft Graph (or another API)
4. Choose Application permissions
5. Add scopes such as:
   • Sites.Read.All
   • Sites.ReadWrite.All
   • Files.Read.All
   • Files.ReadWrite.All
   • email
   • offline_access
   • openid
   • profile
   • User.Read
6. Click Grant admin consent (requires admin)

Step 5: Use PFX file

1. On ZappySys Connection UI Go to Certificate Tab
2. Change Storage Mode to Local PFX File (or you can Import PFX file in Certificate Storage - User Store / Machine Store and use that way)
3. Supply the pfx file path or select certificate from Local Certificate Store if you imported that way in earlier step
4. Supply the certificate password (same password used in earlier PowerShell script)
5. Test connection see everything is good

Parameters