---
title: Exchange Online Certificate Limitations
slug: exchange-online-certificate-limitations
docTags: 
createdAt: 2025-10-13T02:18:08.597Z
---

The limitations below relate to the use of **application-only authentication**, where Activate connects to Microsoft services using an application identity rather than operating as a signed-in user. Activate uses this model for automated integrations such as Exchange Online, where certificate-based app-only authentication can be used with scoped permissions and RBAC.

| Limitation                                                              | What this relates to                                                                                                                                                                                                                                                                                                                                                                                                                                            | Activate impact                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| ----------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Group photos cannot be set or read**                                  | Microsoft does not expose all group photo operations to applications using application-only authentication. These operations are generally associated with interactive or delegated Microsoft 365 functionality rather than identity lifecycle administration.                                                                                                                                                                                                  | **Not applicable.** Activate does not use group photos as part of user provisioning, group management, access management, or identity lifecycle workflows. The inability to read or update a group's photo therefore has no functional impact on Activate.                                                                                                                                                                                                                                                                 |
| **Group labels cannot be assigned or used**                             | Some Microsoft 365 group metadata and labelling functionality is unavailable or restricted when operating through an application identity. This can include functionality intended to be applied within an interactive Microsoft 365 user experience rather than through an automated identity-management process.                                                                                                                                              | **Not applicable.** Activate does not rely on Microsoft 365 group labels when creating, updating, assigning membership to, or otherwise managing groups. Existing Activate identity-management workflows are therefore unaffected.                                                                                                                                                                                                                                                                                         |
| **Some cmdlets requiring user context are unsupported**                 | Certain Microsoft PowerShell cmdlets are designed to run in the context of an authenticated user. They may depend on information about the current signed-in user or require a delegated user token and therefore cannot be executed using app-only authentication.                                                                                                                                                                                             | **Not applicable to currently supported Activate operations.** Activate's automated workflows are designed around operations that can be performed using service or application identities. Cmdlets that specifically require an interactive user context are not used as part of the supported automated provisioning and lifecycle-management processes. Activate documentation also identifies certificate-based app-only authentication as the authentication model for Exchange Online integrations where applicable. |
| **Actions requiring user MFA or delegated permissions are unsupported** | Application-only authentication has no interactive user session. As a result, an operation that requires an individual user to authenticate, complete an MFA challenge, consent interactively, or provide a delegated permission cannot be performed by the background application identity. This is distinct from authentication to the Activate user portal, where end users can authenticate through Entra ID using OIDC/OAuth2, Conditional Access and MFA. | **Not applicable to Activate's automated identity-management actions.** Background provisioning and lifecycle operations are intentionally designed to run without an interactive user session. Where a person interacts directly with the Activate portal, that user's authentication and MFA requirements are handled separately through Entra ID. An Activate automation therefore does not need to impersonate a user or complete an MFA challenge on the user's behalf.                                               |

#