Skip to content

7. Certificates (Self‑Hosted)

Self‑Hosted mode uses an app‑generated self‑signed certificate to authenticate to Microsoft Graph and Exchange Online.

Generation

From Settings → Microsoft 365 (Assistant guided card, or Manual) click Generate certificate. Scalio Nexus then:

  • creates a self‑signed certificate,
  • keeps the private key securely inside the application,
  • gives you the public certificate (.cer) to register with your app.

Validity is capped at ≤ 729 days. (The effective expiry is ~728 days from generation, safely under Entra’s two‑year certificate limit.)

Attaching it to the app

The generated PowerShell bootstrap attaches the public certificate to your app registration as a key credential. Important: the key credential does not carry explicit start/end dates — the certificate’s own validity governs its lifetime. (Supplying mismatched dates previously caused New-MgApplication to error; this is fixed.)

You can Copy PowerShell script or Download .ps1 from the guided card.

Expiry reminder

When the certificate is within 30 days of expiry, a banner appears with a one‑click Regenerate action. A fresh certificate (~728 days remaining) does not trigger the banner.

Renewal

Regenerating produces a new certificate + .cer; re‑run the bootstrap (or upload the new public cert to the existing app registration) so Graph/EXO keep authenticating.