Best Practices for Deploying Add-Ins via CI/CD Pipeline

[jgbitz]

I am writing an Excel Add-In for my organization, and I want to deploy it via the Admin Managed section of the Office Add-Ins dialog, such that only users in our MS 365 Tenant can use and install the Add-In.

I have a CircleCI build pipeline that builds and deploys the latest version of the React app portion of the Add-In, and also creates a versioned, environment-specific (dev, QA, etc) manifest file.

I have set up apps in the Integrated Apps section of our MS 365 admin console for each version of the Add-In in each environment. What I want to do is wire these app instances up to my CI/CD pipeline, such that each time I produce a new manifest file, it is automatically uploaded to MS 365 with the latest version, per environment.

This has proven exceptionally difficult to do. The only way I can seem to find to do this in an automated fashion is by using the O365CentralizedAddInDeployment Powershell Module, and it seems like this CmdLet can only be used with a real user account and not a service principal. I was hoping that I could handle this via Microsoft Graph API or something more modern, but so far I can't find anything.

Am I missing something? What are the current best practices for deploying and updating these Add-Ins in a secure, modern manner?