Introduction PnP PowerShell authentication for Microsoft 365 has evolved significantly over the years. The multi-tenant app registration approach was decommissioned for security reasons, requiring each tenant to set up its own app registration. Fortunately, the PnP team has simplified this process with automated cmdlets that streamline app registration and authentication setup. This guide covers modern PnP PowerShell authentication methods, including interactive login setup, multi-tenant management, and certificate-based authentication. The Evolution of PnP PowerShell Authentication Before: Multi-Tenant App Registration Single shared app registration across all tenants Simplified initial setup but created security concerns Decommissioned for enhanced security Now: Tenant-Specific App Registrations Each tenant needs to create and maintain its own app registration(s) Enhanced security and control Automated setup through PnP cmdlets Method 1: Interactive Login Setup Step 1: Create App Registration Automatically The Register-PnPEntraIDAppForInteractiveLogin cmdlet automatically creates an app registration with default permissions:

When you create an Agent within Copilot Studio, a corresponding App registration is automatically generated. These app registrations are named after the Agent, suffixed with “(Microsoft Copilot Studio)”. You can view these app registrations in the Azure Portal under App registrations > All applications. Agent Certificates and Federated Identity Each app registration associated with a Copilot Studio Agent includes three certificates and two federated credentials as of January 2025. These components enable secure communication between agents and your data sources and services.