Microsoft Azure (Certificate) Service Account — Setup Guide

Overview Use this guide to create a Microsoft Azure (Certificate) service account in MinuteView Console. This account provides SharePoint and Microsoft Graph API access using an X.509 certificate credential instead of a client secret.

It is the same server-to-server (application-only) integration as the Microsoft Azure account, but authentication is signed by the certificate's private key — no client secret is required. Certificates are generally preferred over secrets for production because they can be longer-lived and are harder to leak.

Which Azure account do I need?

• Microsoft Azure — application-only, authenticates with a client secret.
• Microsoft Azure (Certificate) — this page — application-only, authenticates with a certificate.
• Microsoft Azure (OAuth) — delegated, a user signs in and authorises access.

---

Network Requirements

The certificate signs a token request that the MinuteView server sends to Microsoft's identity platform; the server then calls Microsoft Graph directly. The MinuteView server must have outbound internet access to the following domains.

Required Firewall / Proxy Whitelist

The following domains must be accessible via HTTPS (port 443) from the server where MinuteView is installed:

Domain	Purpose
login.microsoftonline.com	OAuth token acquisition (certificate-signed) and token refresh
graph.microsoft.com	Microsoft Graph API calls (SharePoint, OneDrive, user profiles, etc.)

Server Access Required

These domains must be reachable from the server, not from an administrator's PC. All authentication and API calls are made server-side. If the server cannot reach these domains, authentication will fail with a connection error.

---

1) Create an Azure App Registration

1. Sign in to Azure Portal → Microsoft Entra ID → App registrations → New registration
2. Configure:
   • Name: MinuteView Service Account (Certificate)
   • Supported account types: Single tenant (recommended)
   • Redirect URI: Leave blank — not needed for a service account
3. Click Register

From the app's Overview page, note:

• Application (client) ID
• Directory (tenant) ID

---

2) Create and Upload a Certificate

Generate a self-signed certificate (PowerShell)

# Create the certificate in the current user's store
$cert = New-SelfSignedCertificate -Subject "CN=MinuteView-ServiceAccount" `
    -KeyExportPolicy Exportable `
    -KeyLength 2048 `
    -NotAfter (Get-Date).AddYears(2) `
    -CertStoreLocation "Cert:\CurrentUser\My"

# Export the public part (.cer) to upload to Azure
Export-Certificate -Cert $cert -FilePath "minuteview-cert.cer"

# Export the private part (.pfx) to upload to MinuteView
Export-PfxCertificate -Cert $cert -FilePath "minuteview-cert.pfx" `
    -Password (ConvertTo-SecureString "your-password" -AsPlainText -Force)

Upload the public certificate to Azure

1. In the app registration, go to Certificates & secrets → Certificates
2. Click Upload certificate, select the .cer file, add a description, and click Add

You upload the .cer (public key) to Azure, and the .pfx (with private key) to MinuteView in step 5.

---

3) Configure API Permissions

1. Go to API permissions → Add a permission → Microsoft Graph → Application permissions
2. Add the permissions your integration needs, e.g.:
   • Sites.ReadWrite.All — SharePoint site access
   • Files.ReadWrite.All — file access
   • User.Read.All — read user profiles (if required)
3. Click Grant admin consent for [Organization] and confirm

---

4) (Optional) Assign Azure RBAC Roles

If the account also needs to access Azure resources (Storage, Key Vault, etc.), assign the appropriate RBAC roles to the app's object ID at the relevant scope. This is only needed for resource-plane access — Graph permissions above cover SharePoint/OneDrive.

---

5) Create the Service Account in MinuteView Console

1. Navigate to Console → Service Accounts
2. Click New
3. Set Service Account Type to Microsoft Azure (Certificate)
4. Fill in the fields:

Field	Description	Example
Tenant Id	Directory (tenant) ID from step 1	87654321-4321-4321-4321-210987654321
Client Id	Application (client) ID from step 1	12345678-1234-1234-1234-123456789012
Certificate (.pfx)	Upload your .pfx file — it is converted and stored securely	minuteview-cert.pfx
Certificate Password	The password used when the PFX was exported (leave blank if none)	(sensitive)
Scope	Microsoft API scope — leave the default unless targeting a specific API	https://graph.microsoft.com/.default

5. Click Test Connection to verify authentication
6. Click Save

Certificate must match

The certificate you upload here (.pfx, with private key) must be the same certificate whose public .cer you uploaded to the Azure app registration in step 2. If they differ, Azure will reject the signed token request.

---

6) Token Management

MinuteView handles tokens automatically:

• Access token: used for API calls (expires in ~60–90 minutes)
• Automatic refresh: MinuteView requests a new certificate-signed token before expiry — no user interaction

---

7) Troubleshooting

Connection error / "Failed to retrieve authentication token"

• The most common cause is the server having no outbound internet access. See Network Requirements above.

AADSTS700027 / certificate mismatch or not found

• Ensure the .cer uploaded to Azure and the .pfx uploaded to MinuteView are the same certificate.
• Confirm the certificate has not expired.

AADSTS700016: Application not found

• Verify the Client ID and that the app registration exists in the correct tenant.

Certificate password errors

• Confirm the Certificate Password matches the password used when exporting the PFX. Leave it blank only if the PFX was exported without one.

Insufficient privileges

• Verify the required Graph Application permissions are added and admin consent was granted.

---

Maintenance

• Certificate expiry: certificates have a fixed lifetime. Generate and upload a new one before expiry — update both the Azure app registration (.cer) and the MinuteView service account (.pfx).
• Rotation: you can add the new certificate alongside the old one in Azure, switch MinuteView to it, then remove the old certificate after verifying.