Upload and replace SAML token encryption key

[watahani]

Connect-MgGraph -Scopes "Application.ReadWrite.All";

# Load certificate and create X509Certificate2 object
$certificate = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2;
$certificate.Import("C:\filepath\cert.cer");

# Create  MicrosoftGraphKeyCredential object
$GUID = (New-GUID).GUID
$key = New-Object -TypeName Microsoft.Graph.PowerShell.Models.MicrosoftGraphKeyCredential;
$key.KeyId = $GUID;
$key.Type = "AsymmetricX509Cert";
$key.Usage = "Encrypt";
$key.Key = $certificate.RawData;
 
# Upload certificate
$app = Get-MgApplication -Filter "displayName eq '<appname>'";

if($null  -eq $app.KeyCredentials)
{
  Update-MgApplication -ApplicationId $app.Id -KeyCredentials @($key);
} else {
  $newKeys = $app.KeyCredentials += $key;
  Update-MgApplication -ApplicationId $app.Id -KeyCredentials $newKeys;
}
 
# Set new key as  TokenEncryptionKey
Update-MgApplication -ApplicationId $app.Id -TokenEncryptionKeyId $GUID