Power Platform Community Forum Thread Details

I am testing the Microsoft “HTTP with Microsoft Entra ID (preauthorized)”
connector in Power Automate.

Objective

Create an unattended app-only connection using an Entra application and a
PFX certificate.

The Microsoft connector documentation lists:

Authentication option: Log in using a Client Certificate Auth

Authentication ID: CertOauth

The documented inputs are the Entra resource URI, base resource URL, tenant
ID, client ID and PFX certificate.

What I tested

1. Created the connection using the new Connections experience.
2. Repeated the test from a solution-aware flow using the classic Power
Automate designer.
3. Used the same registered Entra application and PFX in both tests.
4. Independently validated the PFX using .NET X509Certificate2:
- password accepted
- private key present
- certificate not expired
- thumbprint matches the certificate registered on the Entra application

Actual result

Both connection experiences fail before any SharePoint HTTP request is made.

The connection status reports:

Failed to acquire access token for service using client credentials flow.
IdentityProvider=aadcertificate.
Error: Invalid provider type specified.

Expected result

The connection should use the documented CertOauth authentication provider
and acquire an app-only token using the registered application certificate.

Control test

I also tested the newer non-preauthorised “HTTP With Microsoft Entra ID”
connector.

After running Microsoft’s ManagePermissionGrant.ps1 process and granting a
read-only delegated SharePoint permission to one specific user, that delegated
connection was created successfully.

This confirms that:

- the Power Platform environment is functioning
- the SharePoint resource URI is valid
- the delegated connector route works

However, delegated user authentication is not an acceptable permanent
replacement for the required unattended app-only certificate connection.

Environment

- Power Automate Developer environment with Dataverse
- Europe region
- Connector is shown as Premium
- Reproduced in both new and classic connection experiences

Questions

1. Is IdentityProvider=aadcertificate a known regression or provider-mapping
defect for this connector?
2. Why is the documented CertOauth option being persisted or executed as
aadcertificate?
3. Is there a supported workaround that retains app-only PFX certificate
authentication?
4. Is there a supported administrative API or PowerShell method for creating
this certificate-backed connection?
5. Has anyone successfully created a new CertOauth connection recently in a
Power Automate Developer environment?

I can provide private correlation IDs and tenant-specific diagnostic evidence
to Microsoft personnel through a non-public channel.

Categories:

Using connectors

Hi there!

Questions

1. Is IdentityProvider=aadcertificate a known regression or provider-mapping
defect for this connector? No
2. Why is the documented CertOauth option being persisted or executed as
aadcertificate? Yes
3. Is there a supported workaround that retains app-only PFX certificate
authentication? Try this: how to use client certificate auth in http action – Mohamed Ashiq Faleel
4. Is there a supported administrative API or PowerShell method for creating
this certificate-backed connection? No
5. Has anyone successfully created a new CertOauth connection recently in a
Power Automate Developer environment? Not me

I can provide private correlation IDs and tenant-specific diagnostic evidence
to Microsoft personnel through a non-public channel. Create Microsoft ticket, send HAR file, IDs, etc

------------------------------------------------

⭐ If this was helpful, please like and check the box below "Does this answer your question" to help others find this too!

Always glad to help! 💯💯💯💯💯

Tom

Follow me on LinkedIn - Thomas Rice, PMP | LinkedIn