Certificate authentication bindings and limitations

This page's changes and edits · All guidance changes

Microsoft's edit · 17 Apr 17:54 UTC

Merge branch 'main' into CBAGAChanges

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 72338ee · +1 −8 lines · also on GitHub

11 ---

22 title: Microsoft Entra CBA Technical Concepts

33 description: Learn how Microsoft Entra certificate-based authentication (CBA) works and the technical concepts you need to set up and manage CBA.

4 −ms.service: entra-id

5 −ms.subservice: authentication

64 ms.topic: concept-article

75 ms.date: 03/04/2025

8 −ms.author: justinha

96 author: vimrang

10 −manager: dougeby

117 ms.reviewer: vraganathan

128 ms.custom: has-adal-ref, sfi-image-nochange

139 ms.localizationpriority: high

⋯ 65 unchanged lines

7975 :::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/issuer-hints.png" alt-text="Screenshot that shows how to turn on issuer hints." lightbox="media/concept-certificate-based-authentication-technical-deep-dive/issuer-hints.png":::

8076

8177 > [!NOTE]

82 −> After you turn on issuer hints, the CA URL has the format `<tenantId>.certauth.login.microsoftonline.com`.

78 +> After you turn on issuer hints, the CA URL has the format `t<tenantId>.certauth.login.microsoftonline.com`.

8379

8480 :::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/issuer-hints-picker.png" alt-text="Screenshot that shows the certificate picker after you turn on issuer hints.":::

8581

⋯ 15 unchanged lines

10197 - CBA (first factor) and [passwordless phone sign-in](../authentication/howto-authentication-passwordless-phone.md#enable-passwordless-phone-sign-in-authentication-methods) (second factor)

10298 - CBA (first factor) and [FIDO2 security keys](../authentication/howto-authentication-passwordless-security-key-windows.md) (second factor)

10399 - Password (first factor) and CBA (second factor)

104 −

105 −> [!NOTE]

106 −> Currently, using CBA as a second factor on iOS has [known issues](./concept-certificate-based-authentication-mobile-ios.md#known-issues) and is blocked on iOS. We're working to resolve the issues.

107100

108101 Users must have a way to get MFA and register passwordless sign-in or FIDO2 in advance of signing in by using Microsoft Entra CBA.

109102

⋯ 553 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:46 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.