Office365 Certificate Based Authentication - Revision history

Kia@inlogic.dk: /* Test the connection */

2026-06-18T13:31:25Z

Test the connection

← Older revision		Revision as of 13:31, 18 June 2026
Line 87:		Line 87:
	==== Test the connection ====		==== Test the connection ====
	In order to validate if the above configuration worked return to powershell 7 and input the following commands:		In order to validate if the above configuration worked return to powershell 7 and input the following commands:
	~~<code>~~
	~~$AppId = "Your Client ID of the App Registration"~~
	~~</code>~~
	$AppId = "Your Client ID of the App Registration"		$AppId = "Your Client ID of the App Registration"
	$CertificateThumbprint = "Certificate Thumbprint"		$CertificateThumbprint = "Certificate Thumbprint"

Kia@inlogic.dk: /* Test the connection */

2026-06-18T13:31:12Z

Test the connection

← Older revision		Revision as of 13:31, 18 June 2026
Line 87:		Line 87:
	==== Test the connection ====		==== Test the connection ====
	In order to validate if the above configuration worked return to powershell 7 and input the following commands:		In order to validate if the above configuration worked return to powershell 7 and input the following commands:
			<code>
			$AppId = "Your Client ID of the App Registration"
			</code>
	$AppId = "Your Client ID of the App Registration"		$AppId = "Your Client ID of the App Registration"
	$CertificateThumbprint = "Certificate Thumbprint"		$CertificateThumbprint = "Certificate Thumbprint"

Kia@inlogic.dk: /* Test the connection */

2026-06-18T13:30:45Z

Test the connection

← Older revision		Revision as of 13:30, 18 June 2026
Line 90:		Line 90:
	$CertificateThumbprint = "Certificate Thumbprint"		$CertificateThumbprint = "Certificate Thumbprint"
	$Organization = "yourorg.onmicrosoft.com"		$Organization = "yourorg.onmicrosoft.com"
	Connect-ExchangeOnline -AppId $AppId -CertificateThumbprint $CertificateThumbprint -Organization $Organization ~~-ShowBanner:$false~~		Connect-ExchangeOnline -AppId $AppId -CertificateThumbprint $CertificateThumbprint -Organization $Organization

	==== Tenant Settings ====		==== Tenant Settings ====

Kia@inlogic.dk: /* Test the connection */

2026-06-18T13:30:11Z

Test the connection

← Older revision		Revision as of 13:30, 18 June 2026
Line 87:		Line 87:
	==== Test the connection ====		==== Test the connection ====
	In order to validate if the above configuration worked return to powershell 7 and input the following commands:		In order to validate if the above configuration worked return to powershell 7 and input the following commands:
	~~<code>~~
	$AppId = "Your Client ID of the App Registration"		$AppId = "Your Client ID of the App Registration"
	$CertificateThumbprint = "Certificate Thumbprint"		$CertificateThumbprint = "Certificate Thumbprint"
	$Organization = "yourorg.onmicrosoft.com"		$Organization = "yourorg.onmicrosoft.com"
	Connect-ExchangeOnline -AppId $AppId -CertificateThumbprint $CertificateThumbprint -Organization $Organization -ShowBanner:$false		Connect-ExchangeOnline -AppId $AppId -CertificateThumbprint $CertificateThumbprint -Organization $Organization -ShowBanner:$false
	~~</code>~~

	==== Tenant Settings ====		==== Tenant Settings ====

Kia@inlogic.dk at 13:29, 18 June 2026

2026-06-18T13:29:58Z

← Older revision		Revision as of 13:29, 18 June 2026
Line 87:		Line 87:
	==== Test the connection ====		==== Test the connection ====
	In order to validate if the above configuration worked return to powershell 7 and input the following commands:		In order to validate if the above configuration worked return to powershell 7 and input the following commands:
			<code>
	$AppId = "Your Client ID of the App Registration"		$AppId = "Your Client ID of the App Registration"
			$CertificateThumbprint = "Certificate Thumbprint"
	~~<code>~~$CertificateThumbprint = "~~</code><code>~~Certificate Thumbprint"~~</code>~~		$Organization = "yourorg.onmicrosoft.com"
			Connect-ExchangeOnline -AppId $AppId -CertificateThumbprint $CertificateThumbprint -Organization $Organization -ShowBanner:$false
	~~<code>~~$Organization = "~~</code><code>~~yourorg.onmicrosoft.com"~~</code>~~		</code>

	~~<code>~~Connect-ExchangeOnline -AppId $AppId -CertificateThumbprint $CertificateThumbprint -Organization $Organization -ShowBanner:$false</code>

	==== Tenant Settings ====		==== Tenant Settings ====

Ori@inlogic.dk: /* Exchange admin role */

2026-06-09T13:49:39Z

Exchange admin role

← Older revision		Revision as of 13:49, 9 June 2026
Line 76:		Line 76:

	Click on Exchange Administrator.		Click on Exchange Administrator.

	[[File:Role Permission.png\|frameless\|500x500px]]		[[File:Role Permission.png\|frameless\|500x500px]]

	Search for the Azure application.		Search for the Azure application.

Kia@inlogic.dk: /* Install needed powershell modules */

2026-06-09T13:48:06Z

Install needed powershell modules

← Older revision		Revision as of 13:48, 9 June 2026
Line 13:		Line 13:
	UnInstall-Module -Name ExchangeOnlineManagement -AllVersions -Force		UnInstall-Module -Name ExchangeOnlineManagement -AllVersions -Force

	Install-Module -Name ExchangeOnlineManagement -Scope AllUsers -Force ~~-RequiredVersion 3.10.0~~		Install-Module -Name ExchangeOnlineManagement -Scope AllUsers -Force
	If using the wrong version of ExchangeOnlineManagement, you may experiences errors related to missing or not loaded file or assembly.		If using the wrong version of ExchangeOnlineManagement, you may experiences errors related to missing or not loaded file or assembly.

Ori@inlogic.dk: Created page with "Newer versions of UMS requires certificate based authentication in order to connect to your Azure/Entra tenant through the GraphAPI in order to create and maintain users and groups. Below will be a guide how to configure it. == Prerequisites == ==== Install/Update Powershell 7 ==== * Run in Powershell As of writing this, Powershell version 7.6.2 is required to support this kind of authentication. ==== Install needed powershell modules ==== Run these commands in Powe..."

2026-06-09T13:46:00Z

Created page with "Newer versions of UMS requires certificate based authentication in order to connect to your Azure/Entra tenant through the GraphAPI in order to create and maintain users and groups. Below will be a guide how to configure it. == Prerequisites == ==== Install/Update Powershell 7 ==== * Run in Powershell As of writing this, Powershell version 7.6.2 is required to support this kind of authentication. ==== Install needed powershell modules ==== Run these commands in Powe..."

New page

Newer versions of UMS requires certificate based authentication in order to connect to your Azure/Entra tenant through the GraphAPI in order to create and maintain users and groups. Below will be a guide how to configure it.

== Prerequisites ==

==== Install/Update Powershell 7 ====

* Run in Powershell

As of writing this, Powershell version 7.6.2 is required to support this kind of authentication.

==== Install needed powershell modules ====
Run these commands in Powershell 7 administrator mode:
UnInstall-Module -Name ExchangeOnlineManagement -AllVersions -Force

Install-Module -Name ExchangeOnlineManagement -Scope AllUsers -Force -RequiredVersion 3.10.0
If using the wrong version of ExchangeOnlineManagement, you may experiences errors related to missing or not loaded file or assembly.

==== Create a self-signed certificate ====
Open Powershell 7 as administrator and run the following command:
$mycert = New-SelfSignedCertificate -DnsName "inlogic.dk" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(5) -KeySpec KeyExchange -FriendlyName "LiveAtEdu Certificate"
Keep in mind that you need to change the DnsName, choose whichever CertStoreLocation fits your needs and that you can give it whatever FriendlyName that you like.

==== Confirm the thumbprint ====
After creating a new certificate, you should note down the certificate thumbprint, as it will be used later on. You can display it with the following command:
$mycert | Select-Object -Property Subject,Thumbprint,NotBefore,NotAfter

==== Export the certificate ====
Later on, the certificate will need to be uploaded to your App Registration in Azure/Entra. You can export the certificate to .cer with the following command:
$mycert | Export-Certificate -FilePath "C:\temp\LiveAtEduCertificate.cer"
Note that you can always change the location and name of the certificate file by changing the FilePath value

If you're running multiple UMS instances across different servers, and connecting to the same tenant you will need to export the certificate as a pfx and install it on all instances of UMS where LiveAtEdu_Sync is running. In order to export as PFX, you can use the following command:
$mycert | Export-PfxCertificate -FilePath "C:\temp\LiveAtEduCertificate.pfx" -Password $(ConvertTo-SecureString -String "P@ssw0Rd1234" -AsPlainText -Force)

==== Link the certificate to the App Registration ====
If this is your first time setting up an App Registration, then go to:

[[MSGraphPermissions#Creating App Registration|MSGraphPermissions]]

If you already have an App Registration, then find it in your Azure/Entra and click "API Permissions":

[[File:App Registration.png|frameless|500x500px]]

Click APIs my organization uses.

Search for Office 365.

Select Office 365 Exchange Online from the results list.

[[File:API Permissions.png|frameless|500x500px]]

Select Application permissions.

Expand Exchange and select Exchange.ManageAsApp.

Click Add permissions.

After you add the permission, it needs to be granted admin consent. This can be identified by the orange warning triangle next to the recently added permission. For this you need either an application administrator or a global administrator to grant access for the permission that you just added. You can identify when it's been granted by a green checkmark next to the permission.

Click on Certificates & secrets.

Click Certificates > Upload certificate.

[[File:Upload Certificate.png|frameless|500x500px]]

Here you need to upload the .cer certificate you created earlier.

Afterwards check if the thumbprint matches the one you noted down earlier.

==== Exchange admin role ====
Click on Menu > Azure Active Directory.

Select Roles and administrators.

Select All roles and search for exchange.

Click on Exchange Administrator.
[[File:Role Permission.png|frameless|500x500px]]
Search for the Azure application.

Select the application from the results.

Click Add.

==== Test the connection ====
In order to validate if the above configuration worked return to powershell 7 and input the following commands:
$AppId = "Your Client ID of the App Registration"

<code>$CertificateThumbprint = "</code><code>Certificate Thumbprint"</code>

<code>$Organization = "</code><code>yourorg.onmicrosoft.com"</code>

<code>Connect-ExchangeOnline -AppId $AppId -CertificateThumbprint $CertificateThumbprint -Organization $Organization -ShowBanner:$false</code>

==== Tenant Settings ====
Now input the certificate thumbprint into the Office 365 Tenant Settings in the UMS Configurator:

[[File:Certificate Thumbprint.png|frameless]]