Set up modern authentication for SharePoint Online in Nutrient products

Nutrient products such as Nutrient Document Searchability can connect to SharePoint Online using Microsoft Entra ID modern authentication. This approach avoids using a person’s Microsoft 365 username and password. Instead, the Nutrient product authenticates with a Microsoft Entra app registration, a certificate, and SharePoint application permissions.

Prerequisites

Before you begin, ensure you have:

• A Windows computer with PowerShell.
• Permission to register an application in Microsoft Entra ID.
• An administrator who can grant consent for SharePoint application permissions.
• Access to the SharePoint connection settings in your Nutrient product.

Step 1: Create a certificate

Modern authentication uses a certificate to identify the application when it connects to SharePoint.

You’ll create two files:

• A .cer file, which you’ll upload to Microsoft Entra ID.
• A .pfx file, which the Nutrient product will use to authenticate.

The .pfx file contains the private key and is protected with a password.

Create the certificate script

Create a folder for the certificate files — for example:

C:\NutrientCertificate

Open Notepad and paste the following code:

[CmdletBinding()]
param(
    [Parameter(Mandatory = $true)]
    [string]$CommonName,

    [Parameter(Mandatory = $true)]
    [datetime]$StartDate,

    [Parameter(Mandatory = $true)]
    [datetime]$EndDate,

    [SecureString]$Password,

    [string]$OutputPath = ".",

    [switch]$Force
)

$ErrorActionPreference = "Stop"

# Accept either "NutrientSharePoint" or "CN=NutrientSharePoint".
if ($CommonName.StartsWith("CN=", [System.StringComparison]::OrdinalIgnoreCase)) {
    $CommonName = $CommonName.Substring(3)
}

if ([string]::IsNullOrWhiteSpace($CommonName)) {
    throw "CommonName cannot be empty."
}

if ($EndDate -le $StartDate) {
    throw "EndDate must be later than StartDate."
}

$OutputPath = [System.IO.Path]::GetFullPath($OutputPath)

if (-not (Test-Path -LiteralPath $OutputPath)) {
    New-Item -ItemType Directory -Path $OutputPath | Out-Null
}

$pfxPath = Join-Path $OutputPath "$CommonName.pfx"
$cerPath = Join-Path $OutputPath "$CommonName.cer"

if (-not $Force) {
    if (Test-Path -LiteralPath $pfxPath) {
        throw "The file '$pfxPath' already exists. Use -Force to overwrite it."
    }

    if (Test-Path -LiteralPath $cerPath) {
        throw "The file '$cerPath' already exists. Use -Force to overwrite it."
    }
}

if (-not $Password) {
    $Password = Read-Host "Enter a password to protect the PFX certificate" -AsSecureString
}

$certificate = $null
$exportSucceeded = $false

try {
    Write-Host "Creating certificate '$CommonName'..."

    $certificate = New-SelfSignedCertificate `
        -Subject "CN=$CommonName" `
        -CertStoreLocation "Cert:\CurrentUser\My" `
        -Provider "Microsoft Software Key Storage Provider" `
        -KeyAlgorithm RSA `
        -KeyLength 2048 `
        -KeyExportPolicy Exportable `
        -HashAlgorithm SHA256 `
        -NotBefore $StartDate `
        -NotAfter $EndDate

    Write-Host "Exporting PFX certificate..."

    Export-PfxCertificate `
        -Cert $certificate `
        -FilePath $pfxPath `
        -Password $Password `
        -Force:$Force | Out-Null

    Write-Host "Exporting public certificate..."

    Export-Certificate `
        -Cert $certificate `
        -FilePath $cerPath `
        -Force:$Force | Out-Null

    $exportSucceeded = $true

    Write-Host ""
    Write-Host "Certificate created successfully."
    Write-Host ""
    Write-Host "Public certificate:"
    Write-Host "  $cerPath"
    Write-Host "  Upload this file to Microsoft Entra ID."
    Write-Host ""
    Write-Host "Private certificate:"
    Write-Host "  $pfxPath"
    Write-Host "  Configure this file in the Nutrient product."
    Write-Host ""
    Write-Host "Certificate expires:"
    Write-Host "  $($certificate.NotAfter)"
}
finally {
    # The Windows certificate store is only used temporarily.
    # Remove exactly the certificate created by this script.
    if ($null -ne $certificate) {
        try {
            Remove-Item -LiteralPath $certificate.PSPath -Force
        }
        catch {
            Write-Warning "The certificate files were created, but the temporary certificate could not be removed from the Windows certificate store."
            Write-Warning "Certificate thumbprint: $($certificate.Thumbprint)"
        }
    }

    if (-not $exportSucceeded) {
        Write-Warning "Certificate creation or export did not complete successfully."
    }
}

In Notepad, select File > Save As.

Set:

• File name to Create-SelfSignedCertificate.ps1.
• Save as type to All Files.

Save the file in the folder you created earlier.

Using All Files prevents Notepad from saving it as Create-SelfSignedCertificate.ps1.txt.

Your folder should now contain:

C:\NutrientCertificate
└── Create-SelfSignedCertificate.ps1

Open PowerShell in the certificate folder

The easiest way is to open C:\NutrientCertificate in File Explorer.

Click the File Explorer address bar by typing:

powershell

Then press Enter.

If that doesn’t open PowerShell, try the following instead:

pwsh

PowerShell will open with the certificate folder as its current location. You don’t need to run PowerShell as administrator.

Alternatively, open PowerShell from the Windows Start menu and change to the folder manually:

cd "C:\NutrientCertificate"

Replace C:\NutrientCertificate if you saved the script somewhere else.

Run the script

Run the script using:

.\Create-SelfSignedCertificate.ps1 `
    -CommonName "NutrientSharePoint" `
    -StartDate 2026-09-02 `
    -EndDate 2028-09-02

Before running it, update the dates:

• StartDate should normally be today’s date.
• EndDate should be a future expiry date — for example, two years later.
• Use the format YYYY-MM-DD.

Don’t copy the example dates unchanged unless they’re appropriate for your setup.

You can also change NutrientSharePoint to another suitable certificate name.

The script will ask you to enter a password for the .pfx file. Keep this password, as you’ll need it later when configuring the Nutrient product.

After the script completes, the folder will contain:

NutrientSharePoint.cer
NutrientSharePoint.pfx

The .cer file is uploaded to Microsoft Entra ID.

The .pfx file is used by the Nutrient product.

Keep the .pfx file and its password secure.

If PowerShell says the script isn’t digitally signed

On some computers, PowerShell may be configured to prevent unsigned .ps1 files from running.

You may see an error similar to:

Create-SelfSignedCertificate.ps1 is not digitally signed.
You cannot run this script on the current system.

Instead of changing your computer’s permanent PowerShell execution policy, run the script in a temporary PowerShell process with the execution policy set only for that process.

For Windows PowerShell:

powershell.exe -ExecutionPolicy Bypass -File ".\Create-SelfSignedCertificate.ps1" `
    -CommonName "NutrientSharePoint" `
    -StartDate 2026-09-02 `
    -EndDate 2028-09-02

For PowerShell 7:

pwsh -ExecutionPolicy Bypass -File ".\Create-SelfSignedCertificate.ps1" `
    -CommonName "NutrientSharePoint" `
    -StartDate 2026-09-02 `
    -EndDate 2028-09-02

Again, replace the dates with the certificate validity dates you want to use.

This doesn’t permanently change the PowerShell execution policy on the computer. The setting applies only to the temporary PowerShell process used to run the script.

If your organization enforces PowerShell restrictions through company policy, the command may still be blocked. In that case, contact your system administrator rather than changing the organization’s security settings.

Step 2: Create and configure the Microsoft Entra application

Go to the Microsoft Entra admin center(opens in a new tab) and sign in.

Create the application

1. From the left navigation, select App registrations.

2. Select New registration.

3. Enter a name for the application, such as:

   Nutrient Document Searchability

4. Complete the registration and select Register.

The application is created, and its Overview page opens. Copy the Application (client) ID. You’ll need this later as the Azure Application ID in the Nutrient product.

Add SharePoint permissions

1. Select API permissions from the left navigation.

2. Select Add a permission.

3. Select SharePoint.

4. Select Application permissions.

5. Select:

   Sites.FullControl.All

6. Select Add permissions.

7. While still on the API permissions page, select Grant admin consent for [your organization] and confirm when prompted.

You may need a Microsoft Entra administrator to grant consent. Once complete, the permission should show as granted.

Upload the certificate

1. Select Certificates and secrets from the left navigation.
2. Select Certificates.
3. Select Upload certificate.
4. Select the .cer file created in step 1.
5. Select Add.

Upload only the .cer file. The Nutrient product uses the .pfx file later.

Find your Azure AD Tenant

The Azure AD Tenant isn’t on the app registration’s Overview page.

Open the Microsoft Entra tenant Overview(opens in a new tab) and find Primary domain. It’ll usually look similar to:

mycompany.onmicrosoft.com

Copy this value. You’ll need it later as the Azure AD Tenant in the Nutrient product.

Step 3: Configure the Nutrient product

Select Modern Authentication in the SharePoint connection settings, and enter the following values:

For example:

Azure Application ID:
eaf4cbf1-afed-4c8b-a291-8658757dea44

Azure AD Tenant:
mycompany.onmicrosoft.com

Certificate Path:
C:\NutrientCertificate\NutrientSharePoint.pfx

Certificate Password:
********

If you’re using Document Automation Server, this matches the Modern Authentication settings in the Kingfisher user interface.

Test or validate the SharePoint connection. If the connection succeeds, modern authentication is configured.

Troubleshooting

If you receive an access-denied error, check that:

• You added the SharePoint permission under Application permissions.
• You granted Sites.FullControl.All.
• An administrator granted consent.

If the certificate can’t be loaded, check that:

• You’re using the .pfx file.
• The file path is correct.
• The certificate password is correct.
• The account running the Nutrient service can access the file.

If authentication worked before but has stopped, check whether the certificate has expired.

Renew the certificate

Renew the certificate before it expires:

1. Create a new certificate.
2. Upload the new .cer file to the existing Microsoft Entra app.
3. Update the Nutrient product to use the new .pfx file and password.
4. Test the connection.
5. Remove the old certificate after you confirm that the new one works.

This process prevents interruptions to the SharePoint connection.

Conclusion

Modern authentication replaces a shared SharePoint username and password with a certificate and scoped application permissions, so it’s the recommended way to connect Nutrient products to SharePoint Online. Once it’s set up, the only ongoing maintenance is renewing the certificate before it expires.

Start a free trial to connect Document Searchability, Document Automation Server, or another Nutrient product to your own SharePoint environment.