Is there a way to authenticate with Azure ACS and a certificate (App Only context) ?

Hi, I have an application which currently queries SharePoint Online using App Only access, based on Azure ACS (following this documentation).

It is the only way I found to restrict permissions to one given SharePoint site, because Azure AD applications' permissions only allow Sites.*.All permissions (for instance Sites.ReadWrite.All), which is too wide for me, and not allowed by my Organization (this gives access to all SharePoint sites for the tenant).

I currently authenticate against https://accounts.accesscontrol.windows.net/{{TENANT_ID}}/tokens/OAuth/2, with grant type "client_credientials" + ClientId and ClientSecret. This works like a charm, I can access the SharePoint site without giving SharePoint application permissions at Azure AD level !

So far, so good !

However, I have a technical requirement change from security department, and I now need to authenticated using a certificate instead of ClientId + ClientSecret.

I searched for some time but couldn't find a way to use both ACS access + certificate.

I tried the following :

• PnP.Framework.AuthenticationManager().GetACSAppOnlyContext() : Works well with client id + client secret, but no overload for certificates
• PnP.Framework.AuthenticationManager.CreateWithCertificate() : Does not work, need Sites.ReadWrite.All permissions at AAD level
• Using MSAL, Microsoft.Identity.Client.ConfidentialClientApplicationBuilder.Create(ClientId).WithCertificate(certificate).(new Uri($"https://accounts.accesscontrol.windows.net/{Tenantid}")).Build() : Does not work, needs Sites.ReadWrite.All permissions at AAD level

I have no more idea...
Is there some method that I missed, or a way to restrict permissions to one site using Azure AD ?

Thanks !

Start by reviewing AuthenticationManager.GetACSAppOnlyContext() and CreateWithCertificate(), then compare them with the MSAL ConfidentialClientApplicationBuilder approach described in the issue. Determine whether certificate authentication can work with Azure ACS while retaining site-scoped access. Done means documenting a supported entry point or clearly recording the limitation and required permissions.