Certificate authentication bindings and limitations

Source history: extracted from the page's source file at a commit; shared includes are not expanded

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

• CertificateUserIds
• CrlDistributionPoint
• SHA1-PUKEY
• SubjectKeyIdentifier
• SubjectKeyIssuer
• UserPrincipalName

Requirements, exceptions and scope

• How does Microsoft Entra certificate-based authentication work?RequirementExceptionRecommendation8 conditions3 passages
• Understanding issuer hints (Preview)Exception1 condition1 passage
• Enable issuer hintsRecommendation1 passage
• CA trust store update propagationRecommendation1 condition1 passage
• MFA with single-factor certificate-based authenticationRecommendation1 passage
• Options to get MFA capability with Single factor certificatesExceptionRecommendation1 condition2 passages
• Multifactor certificate authenticationExceptionRecommendation1 condition1 passage
• How Microsoft Entra ID resolves multiple authentication policy binding rulesExceptionScopeRecommendation5 conditions6 passages
• Achieve higher security with certificate bindingsExceptionScope2 conditions2 passages
  SHA1-PUKEY
• Define Affinity binding at the tenant level and override with custom rulesRequirementScope1 passage
• How Microsoft Entra ID resolves multiple username policy binding rulesRequirement1 condition1 passage
• Securing Microsoft Entra configuration with multiple username bindingsRequirementExceptionRecommendation5 conditions5 passages
  SubjectKeyIdentifier
• Support for multiple certificates with one Microsoft Entra user account (M:1)RequirementException2 conditions2 passages
  CertificateUserIds
• Support for one certificate with multiple Microsoft Entra user accounts (1:M)RequirementExceptionRecommendation11 conditions6 passages
  SubjectKeyIdentifierSubjectKeyIssuerSHA1-PUKEY
• Understanding the certificate revocation processRequirementExceptionRecommendation3 conditions5 passages
• Understanding CRL validationRequirement2 conditions1 passage
  CrlDistributionPoint
• Enable CRL validationRequirementRecommendation2 conditions3 passages
• Certificate Authority (CA) Scoping (Preview)Exception1 condition1 passage
• Known LimitationsException1 condition1 passage
• How CBA works with a Conditional Access authentication strength policyException2 conditions2 passages
• Understanding Sign-in logsRequirementRecommendation1 condition2 passages
  UserPrincipalName
• Troubleshooting sign-in issues with dynamic variables in sign-in logsRequirementTentative1 condition1 passage
• Test multifactor authenticationScopeTentative1 passage
• Understanding the certificate-based authentication error pageRequirement2 conditions1 passage

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.