Setup
...
Microsoft Exchange Online
Certificate for Exchange Online
6 min
this guide will run you through the steps to create, install and associate a certificate with both an entra id application and activate overview of certificate authentication the {{exo v3 powershell module}} enables app only authentication using a registered azure ad application and a certificate this method is more secure than username/password (credential based) authentication mfa free , unlike ropc flows from july 2025, microsoft will enforce mandatory mfa for non interactive credential flows (e g , ropc) certificate based authentication is exempt from this, making it the preferred method for automation here’s some recommended reading from microsoft docs to deepen your understanding https //learn microsoft com/en us/powershell/exchange/app only auth powershell v2?view=exchange ps there are limitations imposed on the exchange online connection by microsoft, see docid\ llmiexabj afh0xvupzp2 for more detail obtain a certificate you can use either a self signed certificate generated using powershell a certificate issued through your organisation’s standard process for exchange online app authentication, a self signed certificate is fully acceptable in production azure ad does not require a public certificate authority (ca)–issued certificate because the certificate is only used for proving app identity, not for public tls encryption what matters is keeping the private key secure and rotating the certificate periodically here's a guide to creating a self signed certificate docid 0woqi0amjok5gh8ehdmwd install the certificate on the activate server locate the exported pfx file (e g , c \temp\activatecertexo pfx) right click the file and select install pfx when prompted, select local machine as the store location click next if prompted by user account control (uac), click yes click next again to proceed to the password step enter the export password for the certificate and click next choose place all certificates in the following store click browse , select personal , then click ok click next , then finish to complete the import upload the certificate to the azure app registration open the azure portal navigate to the app registration used for exchange online automation in the menu, select certificates & secrets under the certificates tab, click upload certificate select the cer file exported from your certificate (do not use the pfx, which contains the private key) once uploaded, confirm it appears in the list of certificates for the application configure activate to use the certificate open activate studio on the resources > configuration > office365 resource, remove any credentials or pscredentials parameters on the resources > exchange servers > office365 resource, configure the following true 328,328 unhandled content type unhandled content type unhandled content type unhandled content type unhandled content type unhandled content type restart activate services restart the following services to apply the changes activate studio activate orchestrator activate app pool (or run an iis reset)