System-preferred authentication
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 01a20d5 · +2 −0 lines · also on GitHub
⋯ 139 unchanged lines
140140
141141
> [!IMPORTANT]
142142
> Certificate-based authentication (CBA) was previously placed last in the system-preferred authentication order due to known issues with CBA and system-preferred authentication. Now that those issues are resolved, starting March 18th, 2026, certificate-based authentication moved to the third position in the authentication order.
143
+>
144
+> With the current Microsoft Managed behavior, users are directed to the best available authentication methods for both first and second factors based on the system-preferred MFA ordering. While this avoids presenting the password page by default, users on devices without certificates will fail immediately during CBA and must manually select "Sign in another way" to continue with an alternate method.
143145
144146
### How does system-preferred authentication affect the NPS extension?
145147
⋯ 22 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:34 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.