Migrating ACS to Azure AD with Sites.FullControl.All
Migrating from ACS with Sites.FullControl.All permissions to Azure AD with Sites.FullControl.All permissions.
Using Azure Communication Services for authentication with Sites.FullControl.All permissions is being deprecated. If you are using this, you must migrate away from it by 2nd April 2026.
The preferred way of authenticating is using an Azure Portal App Registration. It gives an application an Entra ID (previously Azure AD). The Entra ID manages the authentication and allows invocation of supported apps. This includes SharePoint via API permission scopes.
This document details how to configure an application in Azure Portal and Control Hub changes. It can assist anyone migrating from ACS to Azure AD.
Azure Portal - Application Registration
To register the SharePoint connector application within Azure Portal, follow these steps:
Navigate to https://portal.azure.com
Ensure you are in the correct Azure Directory.
In the search bar, type “App Registrations” or click the shortcut under Azure Services.
Select New registration.
Name - Give the application a user friendly name
Supported account types - Consider if the application will only be used in this directory or others within your organisation.
Redirect URI (optional) – This is not required.
Select Register.
This will take you to the registered application page with an overview of your application. You'll need the Application (client) ID and Directory (tenant) ID from this page later in the process.
Azure Portal - Certificates & Secrets
You can now create and apply a self-signed X.509 certificate. This will authenticate and invoke SharePoint Online via the registered application.
Alternatively, you can use an X.509 certificate issued by your preferred Certificate Authority (CA). Although the certificate is not client facing.
This guide explains creating the self-signed certificate and manifest settings using a Cmdlet. They're needed to use SharePoint CSOM via app-only API permissions. You create them using the PnP.PowerShell Cmdlet, New-PnPAzureCertificate. See Microsofts app only security documentation for more information on this.
Cmdlet Requirements
Running PowerShell 7 running in Administrator mode.
The PnP.PowerShell module to be installed.
Running the Cmdlet
Open a PowerShell terminal as an administrator and run the following command.
New-PnPAzureCertificate -OutPfx pnp.pfx -OutCert pnp.cer -CertificatePassword (ConvertTo-SecureString -String "<Your Password>" -AsPlainText -Force) Save the certificate files in your preferred location and give them a strong password.
Make sure both the .cer and .pfx files are saved. The .cer (public key) will be uploaded to the registered application in Azure Portal. The .pfx (private key) will be uploaded to the Credential Store in Aiimi Insight Engine Control Hub.
Apply the certificate to the registered application
In Azure Portal, select Certificates & Secrets.
Ensure you are on the Certificates tab.
Select Upload certificate.
Select the .cer file you created using New-PnPAzureCertificate.
Description – Add a description to the certificate of what it will be used for.
Select Add.
This certificate is now associated with the registered application in Azure.
Azure Portal - API Permissions
Now you have a registered application with a certificate, you can add API Permissions.
In Azure Portal, navigate to your registered application.
Under Manage, select API Permissions.
There will always be Microsoft Graph, User.Read permissions. This is required and should remain in place.
Select Add a permission.
Under Microsoft APIs, select SharePoint.
Select Application permissions.
This ensures user credentials aren't required for authentication and the context is not scoped to one user.
From the available permissions, select Sites.FullControl.All.
This is currently the only API permission level we readily support for the SharePoint Online connector.
Permission levels lower than this, Sites.Read.All for example are not yet proven and may have unintended consequences.
We are actively working to allow the SharePoint Online connector to run in a read-only mode.
Select Add permission.
The permissions have been applied but not yet granted to the registered application.
You must grant admin consent for any permission applied.
This allows silent authentication for APIs. Without this the application needs a user invoked authentication flow.
Select Grant admin consent for <organisation>.
Select Yes to confirm this selection when prompted.
The Sites.FullControll.All API permission has been applied to the registered application.
Aiimi Insight Engine - Credentials
Now everything is configured in Azure Portal, you need to create credentials in Aiimi Insight Engine's Control Hub.
Within the Control Hub select Credentials.
On the Credentials page, select New Credential.
Credential Type – Select Certificate.
This will reveal the relevant input fields for uploading a certificate.
Credential ID – Enter an ID for this credential.
It must be lowercase, with no spaces or special characters.
Credential Name – Enter a user friendly name for this credential.
Password – Enter the password associated with the certificate you generated earlier.
Expiry Date (DD-MM-YYYY) – This will automatically populate according to the certificate’s expiry.
You can add a date to the certificate expiry if needed. It must not be in the past or after the certificate’s expiry date.
Import Certificate – Either, drag and drop the .pfx file or find it using the “browse files” link.
If using “browse files” in Windows Explorer you must enable “All Files (.)" when searching.
Only valid certificates can be uploaded.
Select Create.
Your new certificate credential is now in the Aiimi Insight Engine Credential Store.
Aiimi Insight Engine – Source Configuration
Now the registered application and credentials are set up, you can configure a SharePoint source.
Within the Control Hub select New Configuration.
If you're applying this to an existing source, find the configuration and select edit.
On the Source tab, select SharePoint from the Source System dropdown.
Client ID – Enter the Application (client) ID of the registered application.
You can find this in the Overview on the Azure Portal.
Directory (Tenant) ID – Enter the Directory (tenant) ID for the registered application.
You can find this in the Overview on the Azure Portal.
Select Credential – Select the certificate credential associated with the .pfx file.
Select Save.
You are now ready to run a crawl without using ACS authentication.
Last updated