Client Credentials for Patch My PC Publisher

Applies to: Patch My PC Publisher V3.x

Patch My PC (PMPC) Publisher authenticates to Microsoft Intune using client credentials associated with an Entra ID app registration. Client credentials allow Publisher to authenticate using app-only (non-interactive) authentication, which is required for automation and unattended publishing.

Microsoft Entra ID supports two client credential types:

Although Publisher supports both methods, certificate-based authentication is strongly recommended.

Tip

Certificate-based authentication is recommended because it uses a "something you have" security model rather than a "something you know" model. The private key is stored securely on the device where Publisher is installed and is never transmitted or shared.

Authentication succeeds only if the calling service can prove possession of the private key, making it significantly harder to compromise than a client secret, which is simply a string value that can be copied, leaked, or reused from elsewhere.

This approach aligns with Microsoft’s security best practices for service-to-service authentication and provides stronger protection for automated workloads that require unattended access to Microsoft Intune.

Note

See the Credentials (including certificates and secrets) section of Security best practices for application properties in Microsoft Entra ID for more guidance on why a certificate should be used instead of a client secret.

Use a Certificate for Authentication

Certificate-based authentication is the preferred and recommended approach for securing Publisher’s access to your Intune tenant. It uses a certificate that your Publisher service holds the private key for, while the public key is uploaded to the Entra ID app registration. This method aligns with Microsoft’s security best practices for service-to-service authentication.

Prerequisites

To use a Certificate for Authentication:

You must have created an Entra ID App Registration.
You need access to the device where Publisher will be installed to create and export certificates.
The certificate must meet the following requirements to be used for app authentication:
- RSA key with 2048-bit minimum key length. (Entra ID currently supports only RSA).
- Signed using SHA256 or stronger. (Entra ID also supports certificates signed with SHA384 and SHA512 hash algorithms).
- Intended for client authentication.
- Valid and not expired.
- Private key accessible to the Publisher service.

Note

The steps below detail how to create a self-signed certificate for client authentication. However, this is not the only supported option. If your organization has an established PKI and your PKI administrators provide a client authentication certificate, you may use that certificate instead.

As long as the certificate meets Entra ID requirements and the private key is installed in the Local Machine certificate store on the server where Publisher is installed, Publisher can use it for authentication in the same way as a self-signed certificate.

See Create a self-signed public certificate to authenticate your application for more information on creating a self-signed certificate for authentication with an app registration.

Step 1: Create a Self-Signed Certificate

To create a Self-Signed Certificate:

Open PowerShell as Administrator on the computer where Publisher is installed.
Run the following PowerShell snippet to create a new self-signed certificate in the Local Machine Personal store.

$subjectName = 'PatchMyPCPublisherIntuneConnector'
$certStore = 'LocalMachine'
$validityPeriod = 12

$newCert = @{
    Subject = "CN=$($subjectName)"
    CertStoreLocation = "Cert:\$($certStore)\My"
    HashAlgorithm = 'sha256'
    KeyExportPolicy = 'NonExportable'
    KeyUsage = 'DigitalSignature'
    KeyAlgorithm = 'RSA'
    KeyLength = 2048
    KeySpec = 'Signature'
    NotAfter = (Get-Date).AddMonths($validityPeriod)
    TextExtension = @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")
}
$cert = New-SelfSignedCertificate @newCert

Open certlm.msc and verify the new certificate appears under Local Machine | Personal.

Whilst still in the elevated PowerShell session, run the following PowerShell snippet to export the public key (.cer) to a temporary folder.

$certFolder = "C:\temp\certs"
New-Item -Path $certFolder -ItemType Directory -Force | Out-Null
Export-Certificate -Cert $cert -FilePath "$certFolder\PatchMyPCIntuneConnector.cer"

Confirm the .cer file exists in C:\temp\certs.

Step 2: Upload the Certificate to the App Registration

To upload the certificate to the App Registration:

In the Microsoft Entra admin center, open the app registration you created.
Navigate to Certificates & secrets.
Under Certificates, click Upload certificate.
Select the exported .cer file and click Add.
Verify the certificate’s thumbprint appears in the list with the correct expiration.

Step 3: Configure Publisher to use the Certificate

Finally, you need to configure Publisher to use the Certificate.

Note

See Authentication Settings for more details on using the certificate for authentication.

Use a Client Secret for Authentication

Client secret–based authentication is supported by Publisher, but it is not the recommended approach for production environments. A client secret is a shared string value (similar to a password) that Publisher uses to authenticate to Microsoft Intune via the Entra ID app registration.

This method may be suitable for:

Short-term testing or proof-of-concept scenarios.
Environments where certificate-based authentication is not possible.

Important

As client secrets are considered a weak client credential, they carry a higher risk of exposure and should be rotated regularly.

Prerequisites

You must have created an Entra ID App Registration.
You have permission to create secrets for the app registration.

Step 1: Create a Client Secret

To create a Client Secret:

Sign in to the Microsoft Entra admin center.
Navigate to Entra ID | App registrations.
Select the app registration created for Publisher.
In the left-hand menu, select Certificates & secrets.
Under Client secrets, select New client secret.

Enter a description (optional).
Choose an expiration period appropriate for your organization.

Note

Microsoft recommends short-lived secrets. Expiration periods of 6 months or less are strongly advised.

Select Add.
After the secret is created, copy the Value immediately and store it securely, as you will not be able to retrieve the secret once you navigate away from the page.