Certificate authentication bindings and limitations

This page's changes and edits · All guidance changes

Microsoft's edit · 7 Aug 2025 12:53 UTC

edits

Microsoft's commit message in MicrosoftDocs/entra-docs · commit c2ebbbc · +17 ~~−17~~ lines · also on GitHub

⋯ 30 unchanged lines

3131

3232 :::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/sign-in.png" alt-text="Screenshot that shows the sign-in page for the MyApps portal.":::

3333

34 −1. Microsoft Entra ID checks whether CBA is enabled for the tenant. If CBA is enabled, the user sees a link to **Use a certificate or smart card** on the password page. If the user doesn't see the sign-in link, make sure that CBA is enabled on the tenant.

34 +1. Microsoft Entra ID checks whether CBA is set up for the tenant. If CBA is set up, the user sees a link to **Use a certificate or smart card** on the password page. If the user doesn't see the sign-in link, make sure that CBA is set up for the tenant.

3535

36 − For more information, see [How do I enable Microsoft Entra CBA?](./certificate-based-authentication-faq.yml#how-does-an-administrator-enable-microsoft-entra-cba-).

36 + For more information, see [How do I turn on Microsoft Entra CBA?](./certificate-based-authentication-faq.yml#how-does-an-administrator-enable-microsoft-entra-cba-).

3737

3838 > [!NOTE]

3939 > If CBA is set up for the tenant, all users see the **Use a certificate or smart card** link on the password sign-in page. However, only users who are in scope for CBA can successfully authenticate for an application that uses Microsoft Entra ID as their identity provider.

⋯ 13 unchanged lines

5353 >

5454 > Make sure that turning off TLS inspection also works for issuer hints with the new URL. Don't hard-code the URL with the tenant ID. The tenant ID might change for business-to-business (B2B) users. Use a regular expression to allow both the previous URL and the new URL to work when you turn off TLS inspection. For example, depending on the proxy, use `*.certauth.login.microsoftonline.com` or `*certauth.login.microsoftonline.com`. In Azure Government, use `*.certauth.login.microsoftonline.us` or `*certauth.login.microsoftonline.us`.

5555

56 − Unless access is allowed, CBA fails if you enable [issuer hints](#issuer-hints-preview).

56 + Unless access is allowed, CBA fails if you turn on [issuer hints](#issuer-hints-preview).

5757

5858 1. Microsoft Entra ID requests a client certificate. The user selects the client certificate, and then selects **OK**.

5959

⋯ 9 unchanged lines

6969

7070 Issuer hints send back a *trusted CA* indicator as part of the TLS handshake. The trusted CA list is set to the subject of the CAs that the tenant uploads to the Microsoft Entra trust store. A browser client or native application client can use the hints that the server sends back to filter the certificates shown in the certificate picker. The client shows only the authentication certificates issued by the CAs in the trust store.

7171

72 −### Enable issuer hints

72 +### Turn on issuer hints

7373

74 −To enable issuer hints, select the **Issuer Hints** checkbox. An [Authentication Policy Administrator](../role-based-access-control/permissions-reference.md#authentication-policy-administrator) should select **I Acknowledge** after making sure that the proxy with TLS inspection enabled is updated correctly, and then save the changes.

74 +To turn on issuer hints, select the **Issuer Hints** checkbox. An [Authentication Policy Administrator](../role-based-access-control/permissions-reference.md#authentication-policy-administrator) should select **I Acknowledge** after making sure that the proxy with TLS inspection set up is updated correctly, and then save the changes.

7575

7676 > [!NOTE]

77 −> If your organization has firewalls or proxies that use TLS inspection, acknowledge that you disabled TLS inspection of the CA endpoint that is capable of matching any name under `[*.]certauth.login.microsoftonline.com`, customized according to the specific proxy in use.

77 +> If your organization has firewalls or proxies that use TLS inspection, acknowledge that you turned off TLS inspection of the CA endpoint that is capable of matching any name under `[*.]certauth.login.microsoftonline.com`, customized according to the specific proxy in use.

7878

79 −:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/issuer-hints.png" alt-text="Screenshot that shows how to enable issuer hints." lightbox="media/concept-certificate-based-authentication-technical-deep-dive/issuer-hints.png":::

79 +:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/issuer-hints.png" alt-text="Screenshot that shows how to turn on issuer hints." lightbox="media/concept-certificate-based-authentication-technical-deep-dive/issuer-hints.png":::

8080

8181 > [!NOTE]

82 −> After issuer hints are enabled, the CA URL has the format `<tenantId>.certauth.login.microsoftonline.com`.

82 +> After you turn on issuer hints, the CA URL has the format `<tenantId>.certauth.login.microsoftonline.com`.

8383

84 −:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/issuer-hints-picker.png" alt-text="Screenshot that shows the certificate picker after issuer hints are enabled.":::

84 +:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/issuer-hints-picker.png" alt-text="Screenshot that shows the certificate picker after you turn on issuer hints.":::

8585

8686 ### CA trust store update propagation

8787

⋯ 28 unchanged lines

116116

117117 We don't allow registration of other methods without first satisfying MFA. If the user doesn't have any other MFA method registered and is in scope for CBA, the user can't use identity proof to register other authentication methods and get MFA.

118118

119 −If the CBA-enabled user has only a single-factor certificate and needs to complete MFA, choose *one* of these options to authenticate the user:

119 +If the CBA-capable user has only a single-factor certificate and needs to complete MFA, choose *one* of these options to authenticate the user:

120120

121121 - The user can enter a password and use a single-factor certificate.

122122 - An Authentication Policy Administrator can issue a temporary access pass.

123123 - An Authentication Policy Administrator can add a phone number and allow voice or text message authentication for the user account.

124124

125 −If the CBA-enabled user hasn't been issued a certificate and needs to complete MFA, choose *one* of these options to authenticate the user:

125 +If the CBA-capable user hasn't been issued a certificate and needs to complete MFA, choose *one* of these options to authenticate the user:

126126

127127 - An Authentication Policy Administrator can issue a temporary access pass.

128128 - An Authentication Policy Administrator can add a phone number and allow voice or text message authentication for the user account.

129129

130 −If the CBA-enabled user can't use a multifactor certificate, such as if they're using a mobile device without smart card support but they need to complete MFA, choose *one* of these options to authenticate the user:

130 +If the CBA-capable user can't use a multifactor certificate, such as if they're using a mobile device without smart card support but they need to complete MFA, choose *one* of these options to authenticate the user:

131131

132132 - An Authentication Policy Administrator can issue a temporary access pass.

133133 - The user can register another MFA method (when the user *can* use a multifactor certificate on a device).

⋯ 129 unchanged lines

263263

264264 1. Looks up the user object by using the username or UPN.

265265 1. Gets the list of all username bindings set up by the Authentication Policy Administrator in the CBA method configuration ordered by the `priority` attribute. Currently, priority isn't shown in the admin center. Microsoft Graph returns the `priority` attribute for each binding. Then, priorities are used in the evaluation process.

266 −1. If the tenant has high-affinity binding enabled or if the certificate value matches a custom rule that requires high-affinity binding, removes all the low-affinity bindings from the list.

266 +1. If the tenant has high-affinity binding configured or if the certificate value matches a custom rule that requires high-affinity binding, removes all the low-affinity bindings from the list.

267267 1. Evaluates each binding in the list until a successful authentication occurs.

268268 1. If the X.509 certificate field of the configured binding is on the presented certificate, Microsoft Entra ID matches the value in the certificate field to the user object attribute value.

269269 - If a match is found, user authentication is successful.

⋯ 199 unchanged lines

469469

470470 To strengthen security and avoid misconfigurations, an Authentication Policy Administrator can require CBA authentication to fail if no CRL is configured for a CA that issues a user certificate.

471471

472 −### Enable CRL validation

472 +### Turn on CRL validation

473473

474 −To enable CRL validation, select the **Require CRL validation (recommended)** checkbox.

474 +To turn on CRL validation, select the **Require CRL validation (recommended)** checkbox.

475475

476476 :::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/require-validation.png" alt-text="Screenshot that shows how to require CRL validation." :::

477477

⋯ 24 unchanged lines

502502

503503 An admin can use CA scoping to define rules that associate a CA (identified by its SKI) with a specific Microsoft Entra group. When a user attempts to authenticate by using a certificate, the system checks whether the issuing CA for the certificate is scoped to a group that includes the user. Microsoft Entra proceeds up the CA chain. It applies all scope rules until the user is found in one of the groups in all the scope rules. If the user isn't in the scoped group, authentication fails, even if the certificate is otherwise valid.

504504

505 −### Enable the CA scoping feature

505 +### Set up the CA scoping feature

506506

507507 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../role-based-access-control/permissions-reference.md#authentication-policy-administrator).

508508 1. Go to **Entra ID** > **Authentication methods** > **Certificate-based authentication**.

⋯ 101 unchanged lines

610610

611611 The next figure shows some of the entries you can find in the sign-in logs.

612612

613 − The first entry requests the X.509 certificate from the user. The **Interrupted** status means that Microsoft Entra ID validated that CBA is enabled in the tenant. A certificate is requested for authentication.

613 + The first entry requests the X.509 certificate from the user. The **Interrupted** status means that Microsoft Entra ID validated that CBA is set up for the tenant. A certificate is requested for authentication.

614614

615615 :::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/entry-one.png" alt-text="Screenshot that shows single-factor authentication entry in the sign-in logs." lightbox="./media/concept-certificate-based-authentication-technical-deep-dive/entry-one.png":::

616616

⋯ 110 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:02 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.