configure an App Registration in the Microsoft CORP tenant to trust certificates based on Subject Name + Issuer instead of thumbprint for service principal authentication?

Question

configure an App Registration in the Microsoft CORP tenant to trust certificates based on Subject Name + Issuer instead of thumbprint for service principal authentication?

Nick Andres 20 Microsoft Employee

How do I configure an App Registration in the Microsoft CORP tenant to trust certificates based on Subject Name + Issuer instead of thumbprint for service principal authentication?

Nick Andres 20 Reputation points Microsoft Employee

2026-02-13T01:45:17.8266667+00:00

Thank you for the response, but it addressed the wrong part of the authentication flow.

CLARIFICATION: We are NOT asking about client-side certificate presentation (MSAL configuration, x5c claims). That already works.

OUR ACTUAL PROBLEM: The App Registration itself only trusts a specific certificate thumbprint. When our certificate auto-renews (same Subject + Issuer, different thumbprint), authentication fails because the App Registration doesn't trust the new thumbprint.

Question: How do I configure the App Registration credential/trust policy to trust certificates based on Subject Name + Issuer instead of specific thumbprint?

Is this a Microsoft Graph API parameter, a CORP tenant-specific feature, or does this capability not exist?

Environment: Microsoft CORP tenant ID (redacted) has an App Registration ID (redacted)

Answer accepted by question author

0 additional answers

Your answer

Nick Andres 20 Reputation points Microsoft Employee

2026-02-13T01:45:17.8266667+00:00

Thank you for the response, but it addressed the wrong part of the authentication flow.

CLARIFICATION: We are NOT asking about client-side certificate presentation (MSAL configuration, x5c claims). That already works.

OUR ACTUAL PROBLEM: The App Registration itself only trusts a specific certificate thumbprint. When our certificate auto-renews (same Subject + Issuer, different thumbprint), authentication fails because the App Registration doesn't trust the new thumbprint.

Question: How do I configure the App Registration credential/trust policy to trust certificates based on Subject Name + Issuer instead of specific thumbprint?

Is this a Microsoft Graph API parameter, a CORP tenant-specific feature, or does this capability not exist?

Environment: Microsoft CORP tenant ID (redacted) has an App Registration ID (redacted)

Answer 1

Hello Nick Andres,

As discussed offline, this is not supported in Microsoft Entra ID.

For application and service principal authentication, App Registrations only trust certificates that are explicitly added to the app and matched by their thumbprints. Trust based on Subject Name and Issuer is not available for applications.

There is no portal setting, Microsoft Graph API parameter, tenant policy, or CORP-specific feature to enable this.

When a certificate renews, the thumbprint changes, even if the Subject and Issuer stay the same. Because of this, authentication will fail until the new certificate is added to the App Registration. This is expected behavior.

The supported approach is to automate certificate renewal and update the App Registration when the new certificate is issued, ideally keeping overlapping certificates to avoid downtime. If the workload runs in Azure, Managed Identity can also be considered to remove certificate management.

In short, App Registrations only support thumbprint-based certificate trust, and subject/issuer-based trust is not available today.

Hope this helps! Feel free to reach out for further queries.

Share via

configure an App Registration in the Microsoft CORP tenant to trust certificates based on Subject Name + Issuer instead of thumbprint for service principal authentication?

0 additional answers

Your answer