---
title: Certificate for Exchange Online
slug: certificate-for-exchange-online
createdAt: 2025-08-06T19:23:54.796Z
---

This guide will run you through the steps to create, install and associate a certificate with both an Entra ID application and Activate

# Overview of Certificate Authentication

The EXO V3 PowerShell Module enables **App-only authentication** using a registered **Azure AD application** and a **certificate**. This method is:

- **More secure** than username/password (credential-based) authentication.
- **MFA-free**, unlike ROPC flows.

:::hint{type="warning"}
From July 2025, Microsoft will enforce mandatory MFA for non-interactive credential flows (e.g., ROPC). Certificate-based authentication is exempt from this, making it the preferred method for automation.
:::

Here’s some recommended reading from Microsoft Docs to deepen your understanding. 

[App-only authentication for unattended scripts in Exchange Online PowerShell and Security & Compliance PowerShell](https://learn.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps)

:::hint{type="warning"}
There are limitations imposed on the Exchange Online connection by Microsoft, see [Exchange Online Certificate Limitations](docId\:LLMieXabj-AFH0XVUPzp2) for more detail.
:::



# Obtain a Certificate

You can use either:

- A **self-signed certificate** generated using PowerShell.
- A certificate issued through your organisation’s standard process.

:::hint{type="info"}
For Exchange Online app authentication, a self-signed certificate is fully acceptable in production. Azure AD does not require a public certificate authority (CA)–issued certificate because the certificate is only used for proving app identity, not for public TLS encryption. What matters is keeping the private key secure and rotating the certificate periodically.
:::

Here's a guide to creating a self-signed certificate [Create a Self-Signed Certificate for EXO Authentication](docId:0woqi0AmjOk5Gh8EhDmWd) 

# Install the Certificate on the Activate Server

1. Locate the exported pfx file (e.g., C:\Temp\ActivateCertEXO.pfx).
2. Right-click the file and select **Install PFX**.
3. When prompted, select **Local Machine** as the store location.
4. Click **Next**.
5. If prompted by User Account Control (UAC), click **Yes**.
6. Click **Next** again to proceed to the password step.
7. Enter the export password for the certificate and click **Next**.
8. Choose **Place all certificates in the following store**.
9. Click **Browse**, select **Personal**, then click **OK**.
10. Click **Next**, then **Finish** to complete the import.

# Upload the Certificate to the Azure App Registration

1. Open the **Azure portal**.
2. Navigate to the **App Registration** used for Exchange Online automation.
3. In the menu, select **Certificates & secrets**.
4. Under the **Certificates** tab, click **Upload certificate**.
5. Select the .cer file exported from your certificate (do not use the .pfx, which contains the private key).
6. Once uploaded, confirm it appears in the list of certificates for the application.

# Configure Activate to Use the Certificate

1. Open **Activate Studio**.
2. On the **Resources > Configuration > Office365 **resource, **remove **any **Credentials** or **PSCredentials **parameters.
3. On the **Resources > Exchange Servers > Office365** resource, configure the following:

| Parameter         | Value                                                                                                                                                                                         |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **PSCredentials** | Network Credential with:<br />• **Username:** &#x7B;APPID}@&#x7B;tenant}.onmicrosoft.com<br />• **Password:** leave blank (Thumbprint method) or enter the certificate password (File method) |
| **PSCertificate** | String parameter type<br />**Thumbprint:** "THUMBPRINT"<br />**or File path:** "C:\path\to\cert.pfx"                                                                                          |

# Restart Activate Services

Restart the following services to apply the changes:

- **Activate Studio**
- **Activate Orchestrator**
- **Activate App Pool** (or run an IIS reset)