Certificates: Azure App Registration versus Azure Key Vault

Joshua Thompson 201 Reputation points
2022-02-28T22:35:13.333+00:00

I have an Azure App registration created to automate authentication to SharePoint online via a powershell command.
We log on to SPO using tenant ID, Client ID, and the thumprint of a certifiate loaded onto the client machine.
This certificate is stored with the Azure App Registration. I believe I want to move it into a key Vault for more protection.

Can a certificate used in an Azure App Registration be moved to an Azure Key Vault? If so what do you do with the cert that is in the Azure App Registration area? Delete it? Will the thumbprint change?

Is there a way to lock down an Azure App registration / Certificate in a key vault so that only certain scrips can use it (example: ExampleFileName.ps1?

What is the difference between Secrets and Certificates in Azure App Registration versus Certificate and Secrets in a Azure KeyVault?

Azure Key Vault
Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
1,112 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,453 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sam Cogan 10,157 Reputation points MVP
    2022-03-01T17:17:53.867+00:00

    No, a certificate used for an app registration must be added directly to the app registration, it cannot be in Key Vault.
    However, the app registration only has the public key assigned to it, not the private key, so the security concerns around this should be minimal.

    2 people found this answer helpful.