Certificate authentication bindings and limitations

This page's changes and edits · All guidance changes

Microsoft's edit · 14 Aug 2025 22:22 UTC

edits per Shawn

Microsoft's commit message in MicrosoftDocs/entra-docs · commit e8d2c3e · +13 −9 lines · also on GitHub

⋯ 59 unchanged lines

6060 :::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/cert-picker.png" alt-text="Screenshot that shows the certificate picker." lightbox="./media/concept-certificate-based-authentication-technical-deep-dive/cert-picker.png":::

6161

6262 1. Microsoft Entra ID verifies the certificate revocation list (CRL) to make sure that the certificate isn't revoked and that it's valid. Microsoft Entra ID identifies the user by using the [username binding configured](how-to-certificate-based-authentication.md#step-4-configure-username-binding-policy) on the tenant to map the certificate field value to the user attribute value.

63 −1. If a unique user is found via a Microsoft Entra Conditional Access policy that requires MFA and the [certificate authentication binding rule](how-to-certificate-based-authentication.md#step-3-configure-an-authentication-binding-policy) satisfies MFA, Microsoft Entra ID signs in the user immediately. If MFA is required but the certificate satisfies only a single factor, if the user is already registered, passwordless sign-in and FIDO2 are offered as second factors.

63 +1. If a unique user is found via a Microsoft Entra Conditional Access policy that requires multifactor authentication (MFA) and the [certificate authentication binding rule](how-to-certificate-based-authentication.md#step-3-configure-an-authentication-binding-policy) satisfies MFA, Microsoft Entra ID signs in the user immediately. If MFA is required but the certificate satisfies only a single factor, if the user is already registered, passwordless sign-in and FIDO2 are offered as second factors.

6464 1. Microsoft Entra ID completes the sign-in process by sending a primary refresh token back to indicate successful sign-in.

6565

6666 If user sign-in is successful, the user can access the application.

⋯ 4 unchanged lines

7171

7272 ### Turn on issuer hints

7373

74 −To turn on issuer hints, select the **Issuer Hints** checkbox. An [Authentication Policy Administrator](../role-based-access-control/permissions-reference.md#authentication-policy-administrator) should select **I Acknowledge** after making sure that the proxy with TLS inspection set up is updated correctly, and then save the changes.

74 +To turn on issuer hints, select the **Issuer Hints** checkbox. An [Authentication Policy Administrator](../role-based-access-control/permissions-reference.md#authentication-policy-administrator) should select **I Acknowledge** after making sure that the proxy that has TLS inspection set up is updated correctly, and then save the changes.

7575

7676 > [!NOTE]

7777 > If your organization has firewalls or proxies that use TLS inspection, acknowledge that you turned off TLS inspection of the CA endpoint that is capable of matching any name under `[*.]certauth.login.microsoftonline.com`, customized according to the specific proxy in use.

⋯ 213 unchanged lines

291291

292292 #### Cloud-only accounts (M:1)

293293

294 −For cloud-only accounts, you can map multiple certificates (up to five) to use by populating the `certificateUserIds` field (on the **Authorization info** tab in the admin center) with unique values identifying each certificate. If the organization uses high-affinity bindings, like `IssuerAndSerialNumber`, values in `certificateUserIds` might look like the following example:

294 +For cloud-only accounts, you can map multiple certificates (up to five) to use by populating the `certificateUserIds` field with unique values to identify each certificate. To map the certificates, in the admin center, go to the **Authorization info** tab.

295295

296 +If the organization uses high-affinity bindings like `IssuerAndSerialNumber`, values in `certificateUserIds` might look like the following example:

297 +

296298 `X509:<I>DC=com,DC=contoso,CN=CONTOSO-DC-CA<SR>cD2eF3gH4iJ5kL6mN7-oP8qR9sT`\

297299 `X509:<I>DC=com,DC=contoso,CN=CONTOSO-DC-CA<SR>eF3gH4iJ5kL6mN7oP8-qR9sT0uV`

298300

⋯ 1 unchanged line

300302

301303 #### Hybrid synchronized accounts (M:1)

302304

303 −For synchronized accounts, you can map multiple certificates. In Windows Server Active Directory, populate the `altSecurityIdentities` field with the values that identify each certificate. If your organization uses high-affinity bindings (that is, strong authentication) like `IssuerAndSerialNumber`, the values might look like these examples:

305 +For synchronized accounts, you can map multiple certificates. In on-premises Active Directory, populate the `altSecurityIdentities` field with the values that identify each certificate. If your organization uses high-affinity bindings (that is, strong authentication) like `IssuerAndSerialNumber`, the values might look like these examples:

304306

305307 `X509:<I>DC=com,DC=contoso,CN=CONTOSO-DC-CA<SR>cD2eF3gH4iJ5kL6mN7-oP8qR9sT`\

306308 `X509:<I>DC=com,DC=contoso,CN=CONTOSO-DC-CA<SR>eF3gH4iJ5kL6mN7oP8-qR9sT0uV`

⋯ 4 unchanged lines

311313

312314 In some scenarios, an organization requires a user to use the same certificate to authenticate into multiple identities. It might be for an administrative account or for a developer or temporary duty account.

313315

314 −In Windows Server Active Directory, the `altSecurityIdentities` field populates the certificate values. A hint is used during sign-in to direct Windows Server Active Directory to the intended account to check for sign-in.

316 +In on-premises Active Directory, the `altSecurityIdentities` field populates the certificate values. A hint is used during sign-in to direct Active Directory to the intended account to check for sign-in.

315317

316318 Microsoft Entra CBA has a different process, and no hint is included. Instead, Home realm discovery identifies the intended account and checks the certificate values. Microsoft Entra CBA also enforces uniqueness in the `certificateUserIds` field. Two accounts can't populate the same certificate values.

317319

⋯ 4 unchanged lines

322324

323325 For cloud-only accounts, create multiple username bindings and map unique values to each user account that uses the certificate. Access to each account is authenticated by using a different username binding. This authentication level applies to the boundary of a single directory or tenant. An Authentication Policy Administrator can map the certificate to use it in another directory or tenant if the values remain unique per account.

324326

325 −Populate the `certificateUserIds` field (on the **Authorization info** tab in the admin center) with a unique value that identifies the certificate. If the organization uses high-affinity bindings (that is, strong authentication) like `IssuerAndSerialNumber` and `SKI`, it might look like the following example:

327 +Populate the `certificateUserIds` field with a unique value that identifies the certificate. To populate the field, in the admin center, go to the **Authorization info** tab.

326328

329 +If the organization uses high-affinity bindings (that is, strong authentication) like `IssuerAndSerialNumber` and `SKI`, the values might look like the following example:

330 +

327331 Username bindings:

328332

329333 - `IssuerAndSerialNumber` > `certificateUserIds`

⋯ 12 unchanged lines

342346

343347 Synchronized accounts require a different approach. Although an Authentication Policy Administrator can map unique values to each user account that uses the certificate, the common practice of populating all values to each account in Microsoft Entra ID makes this approach difficult. Instead, Microsoft Entra Connect should filter the values per account to unique values populated into the account in Microsoft Entra ID. The uniqueness rule applies to the boundary of a single directory or tenant. An Authentication Policy Administrator can map the certificate to use it in another directory or tenant if the values remain unique per account.

344348

345 −The organization might also have multiple Windows Server Active Directory forests that contribute users to a single Microsoft Entra tenant. In this case, Microsoft Entra Connect applies the filter to each of the Windows Server Active Directory forests with the same goal: populate only a specific, unique value to the cloud account.

349 +The organization might also have multiple Active Directory forests that contribute users to a single Microsoft Entra tenant. In this case, Microsoft Entra Connect applies the filter to each of the Active Directory forests with the same goal: populate only a specific, unique value to the cloud account.

346350

347 −Populate the `altSecurityIdentities` field in Windows Server Active Directory with the values that identify the certificate. Include the specific certificate value for that user account type (such as `detailed`, `admin`, or `developer`). Select a key attribute in Windows Server Active Directory. The attribute tells synchronization which user account type the user is evaluating (such as `msDS-cloudExtensionAttribute1`). Populate this attribute with the user type value you want to use, such as `detailed`, `admin`, or `developer`. If the account is the user’s primary account, the value can be empty or NULL.

351 +Populate the `altSecurityIdentities` field in Active Directory with the values that identify the certificate. Include the specific certificate value for that user account type (such as `detailed`, `admin`, or `developer`). Select a key attribute in Active Directory. The attribute tells synchronization which user account type the user is evaluating (such as `msDS-cloudExtensionAttribute1`). Populate this attribute with the user type value you want to use, such as `detailed`, `admin`, or `developer`. If the account is the user’s primary account, the value can be empty or NULL.

348352

349353 Check that the accounts look similar to these examples:

350354

⋯ 17 unchanged lines

368372 To sync to `certificateUserIds`:

369373

370374 1. Configure Microsoft Entra Connect to add the `alternativeSecurityIds` field to the metaverse.

371 −1. For each Windows Server Active Directory forest, configure a new custom inbound rule with a high precedence (a low number, below 100). Add an `Expression` transform with the `altSecurityIdentities` field as the source. The target expression uses the key attribute that you selected and populated, and it uses the mapping to the user types you defined.

375 +1. For each on-premises Server Active Directory forest, configure a new custom inbound rule with a high precedence (a low number, below 100). Add an `Expression` transform with the `altSecurityIdentities` field as the source. The target expression uses the key attribute that you selected and populated, and it uses the mapping to the user types you defined.

372376

373377 For example:

374378

⋯ 352 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:46 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.