Update-EntraAppProxyCertificate

Microsoft Entra application proxy applications published using a custom domain require a TLS certificate to be uploaded to the service. This script replaces that certificate using the Microsoft Graph API.

The certificate must be supplied as a PFX file including the private key. When updating a single application by name, the subject or a subject alternative name must match the host name in the application's external URL.

When the -UpdateAll switch is used, the script enumerates all application proxy applications in the tenant and updates every application whose external URL host matches a name in the supplied certificate. A wildcard certificate, a multi-SAN certificate, or a combination of both is supported. Applications are discovered using the Microsoft Entra on-premises application template. Applications created programmatically without this template are not discovered and must be updated individually using the -Name parameter.

The signed in account requires the Cloud Application Administrator role (or higher) and the Directory.ReadWrite.All and Application.ReadWrite.All delegated Microsoft Graph permissions.

Application proxy configuration is exposed only in the Microsoft Graph beta endpoint.

Each run is recorded in a transcript written to $env:ProgramData\RMHCI\PowerShell with a date and time stamped file name.

The script emits one result object per application to the pipeline and sets an exit code for callers that cannot consume pipeline output, such as Task Scheduler or CI/CD pipelines. Exit code 0 indicates all updates completed and were confirmed, 1 indicates the script terminated with an error before processing completed (returned when the script is run with powershell.exe or pwsh; when the script is called from within PowerShell, a terminating error is thrown instead), 2 indicates one or more updates failed, and 3 indicates one or more updates completed but could not be confirmed.