This thumbprint must also be provided in the ClientCertificateThumbprint parameter in the Install-NetworkController or Set-NetworkController cmdlet so that Network Controller can authorize this user.
The thumbprint must be provided only if the network controller client authentication is X509 certificates.
Get-NetworkController retrieves that client authentication and authorization information.