Certificate authentication bindings and limitations
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit e0c22cd · +73 −0 lines · also on GitHub
⋯ 460 unchanged lines
461461
462462
:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/exempted.png" alt-text="Screenshot of CAs that are exempted from CRL validation." :::
463463
464
+## Certificate Authority (CA) Scoping (Preview)
465
+
466
+Certificate Authority (CA) Scoping in Microsoft Entra allows tenant administrators to restrict the use of specific certificate authorities (CAs) to defined user groups. This feature enhances the security and manageability of certificate-based authentication (CBA) by ensuring that only authorized users can authenticate using certificates issued by specific CAs.
467
+
468
+CA Scoping is particularly useful in multi-PKI or B2B scenarios where multiple CAs are used across different user populations. It helps prevent unintended access and supports compliance with organizational policies.
469
+
470
+**Key Benefits**
471
+- Restrict certificate usage to specific user groups
472
+- Support for complex PKI environments with multiple CAs
473
+- Enhanced protection against certificate misuse or compromise
474
+- Visibility into CA usage via sign-in logs and monitoring tools
475
+
476
+CA Scoping allows admins to define rules that associate a CA (identified by its Subject Key Identifier, or SKI) with a specific Microsoft Entra group. When a user attempts to authenticate using a certificate, the system checks whether the certificate’s issuing CA is scoped to a group that includes the user. Entra walks up the CA chain and applies all the scope rules until user is found in one of the groups in all the scope rules. If the user is not in the scoped group, authentication fails, even if the certificate is otherwise valid.
477
+
478
+### Steps to enable CA scoping feature
479
+
480
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../role-based-access-control/permissions-reference.md#authentication-policy-administrator).
481
+1. Browse to **Entra ID** > **Authentication methods** > **Certificate-based Authentication**.
482
+1. Under **Configure**, go to **Certificate issuer scoping policy**
483
+
484
+:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/ca-scoping-config.png" alt-text="Screenshot of CA scoping policy.":::
485
+
486
+1. Select **Add rule**
487
+
488
+:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/ca-scoping-add-rule.png" alt-text="Screenshot of CA scoping add rule.":::
489
+
490
+1. Select **Filter CAs by PKI**. **Classic CAs** will show all the CAs from classic CA store and selecting a specific PKI will show all the CAs from the selected PKI. Select a PKI.
491
+
492
+:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/ca-scoping-pki-filter.png" alt-text="Screenshot of CA scoping PKI filter.":::
493
+
494
+1. **Certificate issuer** drop down will show all the CAs from the selected PKI. Select a CA to create a scope rule.
495
+
496
+:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/ca-scoping-select-cert.png" alt-text="Screenshot of CA scoping select CA.":::
497
+
498
+1. Select **Add group**
499
+
500
+:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/ca-scoping-add-group.png" alt-text="Screenshot of CA scoping add group.":::
501
+
502
+1. Select a group
503
+
504
+:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/ca-scoping-select-group.png" alt-text="Screenshot of CA scoping select group.":::
505
+
506
+1. Select **Add** to save the rule
507
+
508
+:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/ca-scoping-save-rule.png" alt-text="Screenshot of CA scoping save rule.":::
509
+
510
+1. Select **I Acknowledge** and Select **Save** to save CBA config
511
+
512
+:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/ca-scoping-save-cbaconfig.png" alt-text="Screenshot of CA scoping save cbaconfig.":::
513
+
514
+1. To edit or delete a CA scoping policy select "..." on the rule row. Select **Edit** to edit the rule and **Delete** to delete the rule.
515
+
516
+:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/ca-scoping-policy-edit-delete.png" alt-text="Screenshot of CA scoping save cbaconfig.":::
517
+
518
+### Known Limitations
519
+- Only one group can be assigned per CA.
520
+- A maximum of 30 scoping rules is supported.
521
+- Scoping is enforced at the intermediate CA level.
522
+- Improper configuration may result in user lockouts if no valid scoping rules exist.
523
+
524
+### Sign-in log entries
525
+
526
+- Sign in log will show success and in **Additional Details** tab the SKI of the CA from scoping policy rule will be shown.
527
+
528
+:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/sign-in-log-success.png" alt-text="Screenshot of CA scoping rule sign in log success.":::
529
+
530
+- When a CBA authentication fails due to a CA scoping rule, the Basic info tab in the sign-in log will show the error code 500189
531
+
532
+:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/sign-in-log-error.png" alt-text="Screenshot of CA scoping sign in log error.":::
533
+
534
+- End users will see the error message below.
535
+
536
+:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/ca-scoping-policy-user-error.png" alt-text="Screenshot of CA scoping user error.":::
464537
465538
## How CBA works with a Conditional Access authentication strength policy
466539
⋯ 157 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:02 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.