I’m trying to run the Entra ID scan unattended (scheduled task, no interactive user) with the Free Edition, using an app registration + certificate. I can’t make it work and would like to know whether it is supported.
ENVIRONMENT
- PingCastle 4.0.0.31 (latest release on GitHub, published 2026-10-13), Free Edition, dotnet 10.0.12
- Also tested: 4.0.0.20
- Windows Server, domain-joined, NOT Entra-joined (dsregcmd: AzureAdJoined: NO, AzureAdPrt: NO). Same result on a domain-joined workstation.
- Entra app registration (tenant <TENANT_ID>, client <APP_CLIENT_ID>) with a certificate credential, application permissions Directory.Read.All, Reports.Read.All, Policy.Read.All, AuditLog.Read.All, and the Global Reader directory role.
- The same app + certificate authenticates fine to Microsoft Graph with Connect-MgGraph -CertificateThumbprint (data retrieved), so the app, the certificate and the permissions are valid.
WHAT I TESTED
-
PingCastle.exe --entraid --tenantid <TENANT_ID> --clientid <APP_CLIENT_ID> --thumbprint
(certificate in Cert:\CurrentUser\My; tried several argument orders)
→ The interactive “Which identity do you want to use?” menu (1-useprt / 2-askcredential) is still displayed, as if the certificate parameters were ignored. Same with 4.0.0.20 and 4.0.0.31, and same with --export entraguest + the same parameters (4.0.0.20).
→ When stdin/stdout are redirected (scheduled task), it fails immediately with “Exception: Descripteur non valide” (French Windows: “The handle is invalid”) in “main program”, before any scan output, which suggests it tries to display the menu without a console. -
PingCastle.exe --entraid --clientid <APP_CLIENT_ID> --tenantid <TENANT_ID> --p12-file <file.pfx> --p12-pass (4.0.0.20)
→ “Exception: Le mot de passe réseau spécifié est incorrect” (The specified network password is incorrect), although the PFX and its password are valid (Get-PfxCertificate opens it without error; password is alphanumeric only, so no shell quoting issue). -
PingCastle.exe --entraid --use-prt --log-console (4.0.0.31, machine without PRT)
→ No menu, but the sign-in window fails. Log:
GetToken with PRT
RunAuthorize: post to Sign in to your account
ExtractCodeFromResponse
XML parsing failed: ‘>’ is an unexpected token. The expected token is ‘=’. Line 13, position 74.
MFA likely required, continuing authentication flow
HTML content detected that requires user interaction
Showing HTML content to user
NOTES
- “PingCastle.exe --help” lists --tenantid, --clientid, --thumbprint, --private-key, --p12-file, --p12-pass and --use-prt as Entra ID options, but --entraid itself is not documented there.
EXPECTED vs ACTUAL
Expected: with --tenantid/–clientid/–thumbprint (or --p12-file), the scan authenticates non-interactively and generates the report.
Actual: the identity menu is shown (or the process fails with “handle is invalid” when no console is attached).
QUESTIONS
- Is certificate / app-registration authentication for --entraid supposed to work in the Free Edition 4.0.0.31? If yes, what is the exact command line?
- If it is a bug, is a fix planned?
- If unattended Entra scans are Enterprise-only, could you confirm? (Related: the thread “Enhance AzureAD Scanning with Microsoft Graph Permissions”, where it was announced that “Enabling automated scans using App registrations” was the next goal, and later that a completely updated Entra scanner will be released in PingCastle Enterprise 4.0.)