Connect to SharePoint Online with an App ID (certificate)

Optional: sign in as a Microsoft Entra app with a certificate instead of a user account. Never interrupted by sign-in expiry.

SharePoint Migrator normally signs in as you and needs no app registration. If your IT prefers an app registration, or a migration runs for days, connect SharePoint Online with an App ID instead.

	User sign-in (default)	App ID + certificate
Set-up	None	An admin registers an app once
Permissions	Those of your account	Sites.FullControl.All for the whole tenant
MFA prompts	At sign-in	None
Long migrations	Renewed automatically; asks to sign in again only if your IT forces it	Never need a new sign-in
On-premises SharePoint	Windows sign-in	Not available (SharePoint Online only)

SharePoint accepts app sign-in only with a certificate. A client secret works for Microsoft Graph but SharePoint refuses it.

1. Register the app (once, by a Global or Application administrator)

Open the Microsoft Entra admin center → App registrations → New registration.
Name it, for example SharePoint Migrator, choose Single tenant and click Register.
Copy the Application (client) ID.
Go to API permissions → Add a permission → SharePoint → Application permissions → tick Sites.FullControl.All → Add permissions.
Click Grant admin consent and confirm.

2. Create the connection

In SharePoint Migrator open Connections → Create new connection.
Enter a site address (for example https://contoso.sharepoint.com/sites/hr) or the admin center https://contoso-admin.sharepoint.com.
Choose Microsoft 365 – App ID + certificate.
Paste the Application (client) ID. The tenant is worked out from the address; enter the Tenant ID only if asked.
Click Create certificate… and save the .cer file. The private key stays encrypted on this PC.
In the app registration open Certificates & secrets → Certificates → Upload certificate and choose the .cer file.
Wait a minute, then click Connect.

Already have a certificate? Click Use a PEM file… and choose a PEM file that contains the certificate and its private key (not password-protected).

Messages you may see

Message	What to do
The certificate is not registered on the app	Upload the `.cer` file to the app registration, wait a minute, try again.
SharePoint refused the app's sign-in … Sites.FullControl.All	Add the SharePoint application permission and click Grant admin consent.
No app with Application (client) ID … exists	Check the App ID, or enter the Tenant ID if the site uses a custom domain.
The certificate … has expired	Create a new certificate (valid two years) and upload it.

Good to know

Items created by the migration keep their original Created by / Modified by users and dates, exactly as with user sign-in.
The same app works for every site in the tenant and for the admin center, so one registration covers source and destination in the same tenant.
For a migration between two tenants, register an app in each tenant.

Was this article helpful?

Updated 2026-10-18