title: Azure AD: why manifest has empty keyCredentials after running New-MsolServicePrincipalCredential?
body: <p>Or is it ok for the keyCredentials to be empty?
  <em>Probably the first step is where it went wrong, but not sure yet.</em></p>
  
  <p><strong>Expected Result:</strong> Application Manifest has Cert Secrets in keyCredentials, so that application can perform Tokenized authentication as described <a href="https://azure.microsoft.com/en-gb/documentation/samples/active-directory-dotnet-daemon-certificate-credential/" rel="nofollow">here</a> </p>
  
  <p><strong>Actual Result:</strong> keyCredentials is empty</p>
  
  <p><strong>Step1</strong>:  create application in AD by running : </p>
  
  <pre><code>$azureAdApplication=New-AzureADApplication -DisplayName "SetupTest1008" -HomePage "http://www.SetupTest8.com" -IdentifierUris "http://SetupTest8" -Password "SetupTest1234"
  $azureAdApplicationPrincipal=New-AzureADServicePrincipal -ApplicationId $azureAdApplication.ApplicationId
  </code></pre>
  
  <p><strong><em>Notes</em></strong>:
  according to this <a href="https://azure.microsoft.com/en-gb/documentation/samples/active-directory-dotnet-daemon-certificate-credential/" rel="nofollow">article</a>, $azureAdApplication.ApplicationId will be used to upload the cert secret</p>
  
  <p><strong>Step2</strong>: ready the cert secret</p>
  
  <pre><code>.\makecert.exe -r -pe -n "CN=123456" -b 12/15/2014 -e 12/15/2016 -ss my -len 2048 c:\tmp\123456.cer
  
  connect-msolservice -credential $credentials
  $cer = New-Object System.Security.Cryptography.X509Certificates.X509Certificate
  $cer.Import("c:\tmp\123456.cer")
  $binCert = $cer.GetRawCertData()
  $credValue = [System.Convert]::ToBase64String($binCert);
  </code></pre>
  
  <p><strong>Step3</strong>: upload the cert secret</p>
  
  <pre><code>New-MsolServicePrincipalCredential -AppPrincipalId
  $azureAdApplication.ApplicationId -Type asymmetric -Value $credValue -Usage verify
  </code></pre>