►
Description
In this 14-minute demo directed to tenant admins about a new PnP PowerShell cmdlet - Initialize-PnPPowerShellAuthentication, Erwin van Hunen (Valo Intranet) delivers an overview of a capability that greatly streamlines app registration. The new cmdlet allows admins to authenticate towards their SharePoint tenants and Graph (and other scopes) with an app only registration created in Azure AD. This cmdlet executes the entire registration/authentication process in 60 seconds. Benefits include no credential management and a central point for setting up and revoking an app registration. The cmdlet is available today. This demo is extracted from the bi-weekly Microsoft 365 PnP community – General M365 Developer Special Interest Group (SIG) call recorded April 16, 2020.
Presenter: Erwin van Hunen (Valo Intranet) | @erwinvanhunen
Supporting materials:
• InitializePowerShellAuthentication | https://github.com/pnp/PnP-PowerShell/blob/master/Commands/Base/InitializePowerShellAuthentication.cs
All SharePoint PnP Developer Community demos: https://www.youtube.com/playlist?list=PLR9nK3mnD-OWSbg0o9a7mx_E7s2u7h_o2
Learn more about the SharePoint developer community at: http://aka.ms/m365pnp
A
It's
a
it's
a
single
command
that
I'm
gonna
talk
about
today.
That,
hopefully,
will
make
your
life
a
bit
easier
and
what
the
commanded
will
solve
is
actually
allowing
you
to
authenticate,
to
watch
your
tenants
and
towards
the
graph
with
an
app
only
registration
that
you
create
in
the
Azure
ad
and
there's
many
blog
posts
out
there
and
even
the
powershell
repo.
There
is
a
tutorial
on
how
to
set
it
up,
but
you
have
to
carry
the
certificate.
You
have
to
create
an
entry
in
the
azure
ad.
A
You
have
to
upload
the
certificate
you
have
to
current
correct
permission,
scopes
and
and
all
that
stuff
and
a
couple
of
weeks
ago
we
were
having
a
little
meeting
with
team
and
we're
like
country
automate
that
yeah.
Actually,
why
wouldn't
we
be
able
to
automate
that
and
that's
effectively
about
this
commands?
It
does
for
you.
It's
basically
does
all
the
work
for
you.
So
let
me
show
you
how
it
works.
A
I
enter
initialize,
pimpy,
PowerShell
authentication,
I,
give
the
name
of
the
application
and
say
PNP
rocks,
then
my
tenant
that
I
specify
then
I
can
specify
an
existing
path
to
an
existing
certificate.
But
in
this
case
I
just
want
to
create
a
new
certificate.
So
I
can
specify
all
these
parameters
like
common
name
country's,
stayed
all
these
things
that
are
applicable
to
certificates,
but
I'll
just
leave
them
blank.
A
If
I
specify
the
out
path,
it
will
actually
generate
both
the
CR
file
and
the
P
of
X
file,
so
the
public
and
the
private
version
of
your
certificate.
It
will
create
those,
so
you
can
take
them
with
you
somewhere
and
reuse
them
if
you
want,
but
if
you
you
don't
have
to
do
that,
you
can
also
just
specify
the
store
parameter.
A
You
say:
listen
I
want
to
add
that
certificates
to
my
current
current
user
store
in
Windows,
so
this
moment
zone
it
will
create
a
certificate
and
it
will
upload
that
certificate
to
your
user,
store
your
certificate
manager
in
Windows,
and
it
will
create
it
as
your
ad
entry.
So
if
I
press
enter
right
now
see
there's
a
pop-up
behind
the
screen
or
into
the
PowerShell
and
I'm
logging
in
to
my
tenant,
and
it
says
already:
certificates
editor
store
and
now
it
waits
sixty
Seconds.
A
Exhibit
there
we
go,
there
is
my
entry,
so
we
put
my
app
and
if
I
click
on
the
API
permissions,
you
notice
that
we
requested
a
couple
of
close
by
default
group.
Read
white
all
used
to
read
all
sides:
full
control
or
a
user
read.
Oh,
there
are
only
permissions
and
we
require
your
admin
consent.
Now
it
could
already
go
here
if
you
know
where
to
find
and
click
you
just
click
grant
admin
consent.
A
But
in
this
case
we
just
wait
a
bit
here
because
will
actually
launch
that
flow
for
you,
so
it
should
be
done
anytime
soon.
If
I
manage
to
talk
for
60
seconds,
we've
been
testing
a
bit
on
how
long
this
should
take,
and
we
thought
that
60
seconds
is
a
fail.
This
is
a
safety
safe
amount
of
seconds
to
wait.
I
tried
first
me
20,
and
sometimes
it
works.
Sometimes
it
didn't.
It
wants
me
to
login
there.
A
A
Everything
you
see
that
you
can
use
towards
my
after
rich,
although
you
need
certificate
there,
we
go
and
I'm
connected
from
this
Ramadan
I
can
just
do
any
other
commandlets.
Oh
I
get
PP
list,
and
you
see
this
happened
before
so
sometimes
it's
a
bit
tricky.
You
have
to
wait
sometimes
so
some
to
connect
again.
A
A
Executed
site
URL,
there
we
go,
this
is
dumped
through
a
graph.
We
call
the
graph
for
this
commandlets,
so
a
single
way
of
authenticating
both
to
the
graph
into
sharepoint.
We
decline
the
D
and
then
certificates
very
easy
to
set
up.
You
can
provide
your
own
certificate
if
you
want
to.
If
you
don't
want
to,
we
generate
a
certificate
for
you.
As
you
see.
Maybe
we
should
have
waited
a
bit
longer
than
60
seconds.
A
A
If
you
do
not
want
to
use
the
thumbprint,
but
you
want
the
certificate.
The
connect
pin
pink
line
commanders
also
allows
you
to
provide
the
pfx
file
as
an
input
instead
of
a
thumbprint.
You
don't
have
to
add
it
to
your
store.
If
that
is
your
preference,
and
you
want
to
bring
that
certificate
with
you,
so
the
initialize
command
that
also
allows
you,
as
I,
have
mentioned
before,
to
save
the
files
actually
to
your
file
system
and
then
take
them
with.
You
means.
B
B
A
A
Exactly,
although
to
run
in
sure
why
you
need,
of
course,
they're
appropriate
accidents
rise
to
the
edge
ready
to
be
able
to
operate
the
registration,
but
after
that,
no
it's
the
the
permissions
that
has
been
assigned
to
this
app
registration.
That
is
the
one
that
you're
using
yes
in
its.
You
can
use
this
command
it
also
by
the
way,
to
grant
your
own.
A
A
We
created
a
bunch
in
there,
so
if
you
need
a
bit
more
right,
for
instance,
terms
to
read-
or
you
could
add
that,
and
then
we
will
register
those
permissions
also
for
your
app
so
there's
several
ways
of
extending
the
the
creation
of
the
air
registration.
This
is
nothing
you
need
only
for
PowerShell
any
any
code.
You
write
that
uses
an
an
app
registration
app.
Only
registration
can
make
use
of
this
commanded
effectively
where
you
simply
create
the
azure
ad
entry
like
this.
Without
you
generates.
B
A
B
B
You're
trying
to
yeah
anyway,
so
basically
as
one
of
that
authentication
flow,
when
we
granted
the
basic
set
of
permissions
now
somebody
might
over
to
come
back
and
say
well
wait
what
was
the
basic
set
of
permissions?
So
why
do
you
need
to
grant
that
set
of
permissions?
Can
we
actually
repeat
that
because
we
have
till
still
time?
So
if
you.
A
Being
creative,
these
have
to
recreate
graffiti.
Why
just
needed
to
have
access
to
unify
groups
etc,
used
to
rewrite?
Well,
you
do
love
some
users.
You
want
to
be
able
to
grant
users
access
to
your
groups,
for
instance,
and
remove
users
from
your
groups.
Sides
full
control.
Team,
P
PowerShell
is
typically
used
in
that
positive
environments
controlling
things
inside
collections.
We
thought
that
sighs
full
control.
It
is
a
big
one.
We
totally
acknowledge.
A
B
This
is
absolutely
targeted
for
tenant
administrators
to
configure
once,
rather
than
granting
you
a
granting
specific
account
certain
set
of
permissions,
creating
an
azure
IAD
application,
which
system
provided
with
a
thumbprint
and
a
certificate
for
people
who
actually
use
or
and
use
this
on
a
day
to
day
basis.
Just
recapping
things.
Recap
recap:
this
is
always
important.
Its.
B
That
that's
that's
the
whole
point
of
having
the
authentication
as
an
azure
ad
based
authentication
and
an
application
based
authentication.
So
it's
not
about
creating
a
service
account
which
you
didn't
share,
the
account
ID
and
a
password
with
multiple
people
and
what,
if
you
have
an
MFA,
are
enabled,
and
then
that
makes
things
complicated
and
then
you
university
scenario:
you
have
a
a
mobile
phone
which
you
keep
to
somebody
else
to
actually
MFA
in
which
is
insane.
That's
not
what
Microsoft
wants
you
to
do?
Yeah
it's
much
better
to
actually
have
an
application.
B
Specific
registration
like
in
this
case
and
the
BMP
ROK's
is
basically
just
an
application
which
which
the
powershell
commandlets
created
and
then
there's
the
default
set
of
scopes,
and
you
can
add
additional
scopes
here
as
well,
and
then
you
get
the
and
a
certificate
which
is
basically
matching
to
user,
ID
and
the
password
so
to
say
in
imaginary
world,
then
it's
not
precisely
the
same,
but
it's
it's
almost
the
same,
and
then
people
can
use
that
information
to
come
in
if
needed.
Administrator
can
say
that
hey?
B
B
A
With
the
risk
of
going
too
technical,
but
we
said
a
little
static
variables
with
values
underneath
zero
special
session
restarting
it
actually
cleared
those
variables
of
its
current
values
and
allowed
me
to
reconnect
correctly
once
the
connection
fails
using
the
certificates.
That
variable
was
not
cleared
out
correctly
and
there's
no
reason.
I.
B
A
B
Actually,
it's
the
classical
thing
you,
you
might
think
that
sure
has
that
kind
of
capability
and
in
because
this
is
nothing
to
do
with
chip
I'm,
not
in
here
with
B&B.
It's
just
an
ad
application,
there's
an
S
to
expired
sitting,
but
obviously
you
want
to
have
that
warning
so
that
your
application
doesn't
expire
or
it
doesn't
crack
on
now.
What's
interesting
around
this
one
is
I
think
what
Rico
said
it
really
well
just
to
revamp
this
as
well.
B
This
is
really
useful
for
assure
functions
if
you
connect
from
the
asha
functions
to
the
sharepoint
as
an
example
using
the
PMPA
power
show,
because
now
you
can
create
the
certificate
application
registration,
natural
ad
from
your
computer,
and
then
you
have
the
certificate.
You
have
the
alternated
connection,
information
to
call
from
the
asha
functions,
and
then
you
get
the
roger
function
set
up
the
power
show
setting
so
that
when
I'm
hola
everything
magically
works,
it's
super
cool
someone.