---
title: "How to Create Azure Service Principal with Certificates (PowerShell)"
description: "Learn how to authenticate to Azure using a service principal with a self-signed certificate, which offers greater security than using client secrets."
canonical: "https://adamtheautomator.com/service-principal-certificates/"
---

# How to Create Azure Service Principal with Certificates (PowerShell)

> Learn how to authenticate to Azure using a service principal with a self-signed certificate, which offers greater security than using client secrets.

Source: https://adamtheautomator.com/service-principal-certificates/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![How to Create Azure Service Principal with Certificates (PowerShell)](https://adamtheautomator.com/wp-content/uploads/2024/09/8210491e-cbd4-4156-9514-67f821930f3f.webp)

# How to Create Azure Service Principal with Certificates (PowerShell)

[![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)1 October 20241 min. read

Categories: [Cloud](/category/cloud/)

Tags:[Azure](/tag/azure/)[Azure PowerShell](/tag/azure-powershell/)

Table of Contents

*   [Step 1: Switching to the Admin Account](#step-1-switching-to-the-admin-account)
*   [Step 2: Creating a Self-Signed Certificate](#step-2-creating-a-self-signed-certificate)
*   [Step 3: Exporting the Private Key](#step-3-exporting-the-private-key)
*   [Step 4: Importing the Certificate](#step-4-importing-the-certificate)
*   [Step 5: Adding the Certificate to the Application](#step-5-adding-the-certificate-to-the-application)
*   [Step 6: Removing Old Certificates](#step-6-removing-old-certificates)
*   [Step 7: Authenticating with the New Certificate](#step-7-authenticating-with-the-new-certificate)
*   [Step 8: Testing Permissions](#step-8-testing-permissions)
*   [Step 9: Removing the Certificate](#step-9-removing-the-certificate)

When working with Azure, authenticating service principals securely is essential. While client secrets are commonly used, certificates offer a more secure option. In this guide, we will walk through how to create and use a self-signed certificate to authenticate a service principal in Azure.

### Step 1: Switching to the Admin Account

Before beginning, ensure you’re logged in with the appropriate admin credentials:

```
Disconnect-AzAccount
Connect-AzAccount
```

This ensures you’re operating as a global admin in Entra ID.

### Step 2: Creating a Self-Signed Certificate

Next, instead of using a client secret, we’ll create a self-signed certificate. In PowerShell, use the \`New-SelfSignedCertificate\` command to generate it:

```
$cert = New-SelfSignedCertificate -DnsName AzureVMManagement -CertStoreLocation cert:\CurrentUser\My
```

This command creates a certificate named \`AzureVMManagement\` and stores it in the user’s certificate store.

### Step 3: Exporting the Private Key

To link the certificate to the Azure application, you need to export the private key:

```
$secPassword = ConvertTo-SecureString -String "P@ss0word!" -Force -AsPlainText
Export-PfxCertificate -Cert $cert -FilePath C:\VMManagementAppPrivateKey.pfx -Password $secPassword
```

Here, the private key is protected with a password and exported to a \`.pfx\` file.

### Step 4: Importing the Certificate

Now that the certificate is exported, it needs to be imported back as a base-64 encoded binary array for Azure:

```
$PfxCertificate = Get-PfxCertificate -FilePath C:\VMManagementAppPrivateKey.pfx -Password $secPassword
$keyValue = [System.Convert]::ToBase64String($PfxCertificate.GetRawCertData())
```

This converts the certificate data into a format suitable for Azure’s requirements.

### Step 5: Adding the Certificate to the Application

Find your application by name and add the certificate:

```
$app = Get-AzADApplication -DisplayName VMManagement
New-AzADAppCredential -ApplicationId $app.AppId -CertValue $keyValue -StartDate $PfxCertificate.NotBefore -EndDate $PfxCertificate.NotAfter
```

This command attaches the base-64 certificate to the Azure application with valid start and end dates.

### Step 6: Removing Old Certificates

If there are old certificates on the application, clean them up:

```
$oldCerts = (Get-AzADApplication -DisplayName VMManagement).KeyCredentials | sort enddatetime | select -SkipLast 1
$oldCerts | foreach { remove-AzADAppCredential -ApplicationId $app.AppId -KeyId $_.KeyId }
```

This removes all but the latest certificate, ensuring only the active one remains.

### Step 7: Authenticating with the New Certificate

Finally, test authentication using the newly created certificate:

```
Connect-AzAccount -ServicePrincipal -CertificateThumbprint $PfxCertificate.Thumbprint -ApplicationId $app.AppId -TenantId (Get-AzContext).Tenant.TenantId
```

If everything is set up correctly, this will allow you to authenticate to Azure using the service principal and the new certificate.

### Step 8: Testing Permissions

Test if the service principal’s permissions are intact:

```
Get-AzVM
```

You should be able to manage VMs. For further testing, try a disallowed action:

```
Get-AzADApplication
```

This should be blocked if the permissions are correctly set.

### Step 9: Removing the Certificate

To see what happens if the certificate is removed:

```
$cert | Remove-Item
Connect-AzAccount -ServicePrincipal -CertificateThumbprint $PfxCertificate.Thumbprint -ApplicationId $app.AppId -TenantId (Get-AzContext).Tenant.TenantId
```

Without the certificate, the authentication will fail, as Azure requires the certificate to establish trust.

Always ensure certificates are stored safely to prevent any authentication issues.

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fservice-principal-certificates%2F&text=How%20to%20Create%20Azure%20Service%20Principal%20with%20Certificates%20\(PowerShell\))[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fservice-principal-certificates%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fservice-principal-certificates%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/2026/04/featured_image-15.webp)

### [Fix Azure Cost Reporting with a FinOps Tagging Strategy](/fix-azure-cost-reporting-finops-tagging-strategy-3/)

Build an Azure resource tagging taxonomy, enforce it with Azure Policy, and automate remediation of untagged resources to enable accurate FinOps cost allocation and chargebacks.

![](https://adamtheautomator.com/wp-content/uploads/2026/04/featured_image-10.webp)

### [Automate SOC 2 Compliance with PowerShell and Azure](/automate-soc-2-compliance-powershell-azure/)

Learn how to use Azure Policy, the EPAC framework, and PowerShell to automate SOC 2 compliance evidence collection, enforce controls across subscriptions, and build a continuous audit trail.

![](https://adamtheautomator.com/wp-content/uploads/2026/02/featured_image-20.webp)

### [How to Migrate SQL Server to Azure SQL Database](/migrate-sql-server-azure-sql-database/)

Learn how to migrate SQL Server to Azure SQL Database using Azure DMS and SqlPackage, covering assessment with Azure Arc, schema migration, data movement, and post-migration validation.

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)