March 7, 2026

Summary

An internal operations utility was required to display presentation content on screens across various locations. The underlying display hardware used a Linux-based operating system. The goal was to create a digital signage solution that could be managed centrally without requiring direct administration of the individual Linux devices.

Challenge

The primary challenge was to create a system that could automatically and securely update on-screen presentation content from a central, controlled repository. This required a reliable, unattended service capable of fetching the latest content from a SharePoint Online document library and displaying it full-screen. The solution needed to be robust, operate without user interaction, and adhere to modern security best practices for accessing cloud resources.

Objectives

The project was defined by several key objectives:

• Develop a persistent service on a Linux host to retrieve and display PowerPoint presentations.
• Implement secure, certificate-based authentication against Microsoft Entra ID to access SharePoint Online, avoiding less secure methods like client secrets.
• Automate the process of checking for, downloading, and displaying updated presentation files.
• Ensure the solution was operationally resilient, capable of starting automatically after a system reboot or power interruption.
• Design a clean, maintainable codebase with clear separation between configuration, authentication, and application logic.

Approach and Delivery

A modular Python application was designed and built to run as a resident service on the target Linux devices. The core of the solution involved a background poller thread that periodically checked a specified SharePoint document library for new or updated presentation files.

Upon detecting an updated file, the service would download it to a local cache and interrupt the active presentation session to immediately display the new content. This ensured that signage was always showing the most current information available.

To ensure operational readiness and simplify deployment, the solution was packaged with a systemd service definition. This allowed the presentation service to be managed as a standard Linux service, with policies for automatic startup and restarts, ensuring high availability for the digital signage utility.

Technical Implementation

The service was built using Python 3.10+ and a focused set of technologies to meet the project’s requirements.

• Authentication: Secure access to Microsoft 365 was achieved using the Microsoft Authentication Library (MSAL) for Python, configured for certificate-based application authentication against Microsoft Entra ID. This was scoped with the least-privilege Sites.Selected SharePoint permission model.
• SharePoint Integration: The Microsoft Graph API served as the interface to SharePoint Online. The service used site and drive endpoints to resolve the target document library, list available .pptx and .ppt files, and stream the latest version to the local device for display. All operations against SharePoint were strictly read-only.
• Presentation Display: LibreOffice Impress was used to render the presentations in full-screen mode. The Python service controlled the lifecycle of the Impress application using system subprocesses.
• Reliability and Deployment: Preflight checks were built into the application startup sequence to verify the presence of required dependencies like Python and LibreOffice, reducing runtime errors on target hosts. The provided systemd service template included environment settings and restart policies for robust, unattended operation.

Outcome

The project resulted in a fully automated and secure digital signage solution. The key outcome was the ability for operations staff to update on-screen content across multiple locations simply by publishing a new PowerPoint file to a designated SharePoint library. This eliminated the need for direct remote access or manual intervention on the Linux display devices, significantly reducing administrative overhead and improving the speed of content updates.

The system’s design provides a controlled and repeatable process, with local cache management and optional retention settings to support continued function during network interruptions.

Risks, Controls and Governance

Security was a central consideration throughout the project. Several controls were implemented to mitigate risk:

• Authentication: The decision to use certificate-based authentication instead of client secrets significantly strengthened the security posture for this unattended service.
• Permissions: Access to SharePoint was restricted using the Sites.Selected permission model, ensuring the application could only read from a specific, pre-approved site collection.
• Source Control: Sensitive materials including certificates, private keys, authentication tokens, local configuration files, and downloaded content were explicitly excluded from the source code repository.
• Preflight Checks: Integrated validation of the host environment before runtime helped prevent deployment failures and ensured consistent operation.

Key Lessons

This project demonstrated that combining secure Microsoft Cloud services with open-source tools on Linux can create powerful and reliable cross-platform business utilities. The use of certificate-based authentication with least-privilege permissions is a critical pattern for securing unattended services that interact with Microsoft 365.

Furthermore, designing for operational reality from the outset by including deployment assets like systemd service files and preflight checks was essential to delivering a truly robust and low-maintenance solution.

Related Services

• Microsoft Graph API Integrations
  Build secure Microsoft Graph integrations for Microsoft 365 automation, using app registrations, least privilege permissions, auditability, and documented operational controls.
• SSO & Enterprise App Integrations
  SSO and enterprise application integrations using Microsoft Entra ID, standardising access, authentication, and user lifecycle management across SaaS platforms.
• API & System Integrations
  Design and implement API integrations connecting business systems with secure authentication, retries, logging, and supportable middleware patterns operations.
• Passwordless & Strong Authentication
  Deploy passwordless and strong authentication using Microsoft Entra ID, reducing credential risk while improving sign-in experience for users.