Build PowerShell scripts with Microsoft Graph and app-only authentication

2025-06-11

This tutorial teaches you how to build a PowerShell script that uses the Microsoft Graph API to access data using app-only authentication. App-only authentication is a good choice for background services or applications that need to access data for all users in an organization.

Note

To learn how to use Microsoft Graph to access data on behalf of a user, see this user (delegated) authentication tutorial.

In this tutorial, you will:

List users

Tip

As an alternative to following this tutorial, you can download or clone the GitHub repository and follow the instructions in the README to register an application and configure the project.

Prerequisites

Before you start this tutorial, you should have PowerShell installed on your development machine. PowerShell 5.1 is the minimum requirement, but PowerShell 7 is recommended.

You should also have a Microsoft work or school account with the Global administrator role. If you don't have a Microsoft 365 tenant, you might qualify for one through the Microsoft 365 Developer Program; for details, see the FAQ. Alternatively, you can sign up for a one-month free trial or purchase a Microsoft 365 plan.

Note

This tutorial was written with PowerShell 7.2.2 and Microsoft Graph PowerShell SDK version 1.9.5. The steps in this guide might work with other versions, but that hasn't been tested.

Register application for app-only authentication

To enable app-only authentication, register a new application in Microsoft Entra.

Create a self-signed certificate

The Microsoft Graph PowerShell SDK requires a certificate for app-only authentication. For development purposes, a self-signed certificate is sufficient. You need a certificate with the private key installed on the local machine, and the public key exported in a .CER, .PEM, or .CRT file.

Windows
Linux/macOS

On Windows, you can use the pki PowerShell module to generate the certificate.

$cert = New-SelfSignedCertificate -Subject "CN=PowerShell App-Only" -CertStoreLocation `
  "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeySpec Signature -KeyLength 2048 `
  -KeyAlgorithm RSA -HashAlgorithm SHA256
Export-Certificate -Cert $cert -FilePath "./PowerShellAppOnly.cer"

On Linux or macOS, you can use OpenSSL to generate the private and public keys, then use PowerShell to install the private key into a certificate store readable by PowerShell.

Generate a new X509 certificate using the following command.

openssl req -x509 -newkey rsa:2048 -sha256 -days 365 -keyout powershell.pem -out powershell.crt -subj "/CN=PowerShell App-Only"

OpenSSL prompts you for a PEM pass phrase. Enter a pass phrase you can remember.

Create a PFX file using the following command.

openssl pkcs12 -export -out powershell.pfx -inkey powershell.pem -in powershell.crt

OpenSSL prompts you for the pass phrase for powershell.pem. Enter the pass phrase you used in the previous step.
OpenSSL prompts you for an export password. Enter a password you can remember.

Open PowerShell and run the following commands, replacing <export-password> with the export password you used in the previous step.

using namespace System.Security.Cryptography.X509Certificates
$store = [X509Store]::new('My', 'CurrentUser', 'ReadWrite')
$store.Add([X509Certificate2]::new('./powershell.pfx', '<export-password>', [X509KeyStorageFlags]::PersistKeyS
et))
$store.Dispose()

Register application in the Microsoft Entra admin center

Open a browser and navigate to the Microsoft Entra admin center and sign in using a Global administrator account.
Select Microsoft Entra ID in the left-hand navigation, expand Identity, expand Applications, then select App registrations.
Select New registration. Enter a name for your application, for example, Graph App-Only Auth Tutorial.
Set Supported account types to Accounts in this organizational directory only.
Leave Redirect URI empty.
Select Register. On the application's Overview page, copy the value of the Application (client) ID and Directory (tenant) ID and save them. You'll need these values in the next step.
Select API permissions under Manage.
Remove the default User.Read permission under Configured permissions by selecting the ellipses (...) in its row and selecting Remove permission.
Select Add a permission, then Microsoft Graph.
Select Application permissions.
Select User.Read.All, then select Add permissions.
Select Grant admin consent for..., then select Yes to provide admin consent for the selected permission.
Select Certificates and secrets under Manage, then select Certificates.
Select Upload certificate. Upload the PowerShellAppOnly.cer or powershell.crt file you created in the previous step, then select Add.

Note

Notice that, unlike the steps when registering for user authentication, in this section you did configure Microsoft Graph permissions on the app registration. App-only auth uses the client credentials flow, which requires that permissions be configured on the app registration. See The .default scope for details.

Connect with app-only authentication

Disconnect any existing Microsoft Graph connection using the following command.
```
Disconnect-MgGraph
```
Open PowerShell and use the following command to set the $clientID session variable, replacing <your-client-id> with the client ID of your app registration.
```
$clientId = <your-client-id>
```
Set the $tenantId session variable, replacing <your-tenant-id> with your organization's tenant ID.
```
$tenantId = <your-tenant-id>
```
Set the $certificate session variable to the subject of the certificate created in the previous step.
```
$certificate = "CN=PowerShell App-Only"
```
Use the Connect-MgGraph command to authenticate using the certificate from the previous step.
```
Connect-MgGraph -ClientId $clientId -TenantId $tenantId -CertificateName $certificate
```

Use Get-MgContext to verify that you're authenticated with app-only authentication. Verify that AuthType is AppOnly.

PS > Get-MgContext

ClientId              : 2fb1652f-a9a0-4db9-b220-b224b8d9d38b
TenantId              : 601faea3-be45-4960-898f-92b379b17cd9
CertificateThumbprint :
Scopes                : {User.Read.All}
AuthType              : AppOnly
AuthProviderType      : ClientCredentialProvider
CertificateName       : CN=PowerShell App-Only
Account               :
AppName               : PowerShell Graph Tutorial
ContextScope          : Process
Certificate           :
PSHostVersion         : 2022.4.1
ClientTimeout         : 00:05:00

Next step

Get all users

Share via

Build PowerShell scripts with Microsoft Graph and app-only authentication

Prerequisites

Register application for app-only authentication

Create a self-signed certificate

Register application in the Microsoft Entra admin center

Connect with app-only authentication

Next step

Feedback

Additional resources