Certificate authentication bindings and limitations

This page's changes and edits · All guidance changes

Microsoft's edit · 6 Aug 2025 22:14 UTC

edits

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 13366c1 · +4 −4 lines · also on GitHub

⋯ 203 unchanged lines

204204 The following sequence determines the authentication protection level when custom rules overlap:

205205

206206 1. Issuer and policy OID rules take precedence over policy OID rules. Policy OID rules take precedence over certificate issuer rules.

207 −1. Issuer and policy OID rules are evaluated first. If you have a custom rule with issuer CA1 and policy OID **1.2.3.4.5** with MFA, only certificate A that satisfies both the issuer value and the policy OID is given MFA.

207 +1. Issuer and policy OID rules are evaluated first. If you have a custom rule with issuer CA1 and policy OID `1.2.3.4.5` with MFA, only certificate A that satisfies both the issuer value and the policy OID is given MFA.

208208 1. Custom rules that use policy OIDs are evaluated. If you have a certificate A with policy OID of `1.2.3.4.5` and a derived credential B based on that certificate that has a policy OID of `1.2.3.4.5.6`, and the custom rule is defined as a policy OID that has the value `1.2.3.4.5` with MFA, only certificate A satisfies MFA. Credential B satisfies only single-factor authentication. If the user used a derived credential during sign-in and was configured for MFA, the user is asked for a second factor for successful authentication.

209209 1. If there's a conflict between multiple policy OIDs (such as when a certificate has two policy OIDs, where one binds to single-factor authentication and the other binds to MFA), then treat the certificate as single-factor authentication.

210210 1. Custom rules that use issuer CAs are evaluated. If a certificate has matching policy OID and issuer rules, the policy OID is always checked first. If no policy rule is found, then the issuer bindings are checked. The policy OID has a higher strong-authentication binding priority than the issuer.

⋯ 137 unchanged lines

348348

349349 Check that the accounts look similar to these examples:

350350

351 −Forest 1 - Account1 (<[email protected]>):\

351 +Forest 1: Account1 (<[email protected]>):\

352352 `X509:<SKI>aB1cD2eF3gH4iJ5kL6mN7oP8qR`\

353353 `X509:<SHA1-PUKEY>cD2eF3gH4iJ5kL6mN7oP8qR9sT`\

354354 `X509:<PN>[email protected]`

355355

356 −Forest 1 - Account2 (<[email protected]>): \

356 +Forest 1: Account2 (<[email protected]>): \

357357 `X509:<SKI>aB1cD2eF3gH4iJ5kL6mN7oP8qR`\

358358 `X509:<SHA1-PUKEY>cD2eF3gH4iJ5kL6mN7oP8qR9sT`\

359359 `X509:<PN>[email protected]`

360360

361 −Forest 2 – ADAccount1 (<[email protected]>):\

361 +Forest 2: ADAccount1 (<[email protected]>):\

362362 `X509:<SKI>aB1cD2eF3gH4iJ5kL6mN7oP8qR`\

363363 `X509:<SHA1-PUKEY>cD2eF3gH4iJ5kL6mN7oP8qR9sT`\

364364 `X509:<PN>[email protected]`

⋯ 362 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:02 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.