Start RegisterApp Only

Register an App-Only App

An App-Only app runs with its own identity and authenticates with a certificate, so no user signs in. Use it for unattended work. See Understanding Entra ID App Types for more.

Important

With an App-Only app, options that depend on the signed-in user — such as adding/removing your account as Site Collection Admin — are ignored. The app already acts with tenant-wide application permissions.

1. Create a certificate

App-Only authentication needs a certificate. You upload the public key (.cer) to Entra ID and keep the private key (.pfx, protected with a password) for NovaPoint.

A self-signed certificate is enough. From an elevated PowerShell prompt:

# Create the certificate in the current user's store
$cert = New-SelfSignedCertificate -Subject "CN=NovaPoint" -CertStoreLocation "Cert:\CurrentUser\My" `
    -KeyExportPolicy Exportable -KeySpec Signature -NotAfter (Get-Date).AddYears(1)

# Export the public key (upload this to Entra ID)
Export-Certificate -Cert $cert -FilePath "$HOME\NovaPoint.cer"

# Export the private key (used by NovaPoint) — you will be prompted for a password
$pwd = Read-Host "PFX password" -AsSecureString
Export-PfxCertificate -Cert $cert -FilePath "$HOME\NovaPoint.pfx" -Password $pwd

Warning

This PowerShell script is provided for reference only. Review it, and adapt it to your organization's security and certificate policies before running it. Follow your own certificate authority or PKI process where required.

Note

Keep the .pfx file and its password safe — anyone with both can authenticate as this app. Set -NotAfter to match your organization's rotation policy.

More information on certificate credentials

2. Register the App on Entra ID

1. Sign in to Entra ID.

2. If you have access to multiple tenants, use the Directories + subscriptions filter in the top menu to switch to the tenant where you want to register the application.

3. Go to App registrations > New registration.

4. Fill in the Register an application form:

   • Enter a display Name for the application (e.g. NovaPoint App-Only).
   • Under Supported account types, select Accounts in this organizational directory only.
   • Leave Redirect URI empty — App-Only does not need one.

5. Click Register.

More information regarding app registration

3. Upload the certificate

1. Open your App in App registrations.

2. On the left, go to Certificates & secrets > Certificates > Upload certificate.

3. Select the .cer file you exported in step 1 and click Add.

4. Provide permissions to the App

Note

These permissions cover every Solution, so they may be more than a specific Solution needs. Each Solution's own page lists the minimal permissions it requires.

1. In your App, on the left click API permissions.

2. Click Add a permission and add the following Application permissions:

   • Microsoft Graph → Application permissions
     • Directory.ReadWrite.All
   • SharePoint → Application permissions
     • Sites.FullControl.All

3. Click Grant admin consent for <your tenant>.

Note

Some of the newer Directory and Device Management Solutions need extra Application permissions (for example Application.Read.All, AuditLog.Read.All or DeviceManagementManagedDevices.Read.All). Add them only if you plan to use those Solutions — each one is listed on its own page.

5. Configure the App in NovaPoint

1. Open NovaPoint and go to the Settings page.

2. Add a new App-Only app and fill in:

Setting	Where to find this value
Name	Any label you choose to identify this app in NovaPoint.
Tenant ID	Entra ID > App registrations > your App > Overview > Directory (tenant) ID
Client ID	Entra ID > App registrations > your App > Overview > Application (client) ID
Certificate	Click Select and choose the .pfx file you exported in step 1.
Password	The password you set when exporting the .pfx.

3. Save the settings.

Your app is now ready. Head back to Setup to install NovaPoint (if you haven't yet) and run your first Solution.