Certificate-based authentication requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 2131faf · +46 −45 lines · also on GitHub
11
---
2
−title: Overview of Microsoft Entra certificate-based authentication
3
−description: Learn about Microsoft Entra certificate-based authentication without federation
4
−
2
+title: Microsoft Entra CBA Overview
3
+description: Learn about Microsoft Entra certificate-based authentication (CBA) without federation.
54
ms.service: entra-id
65
ms.subservice: authentication
7
−ms.topic: how-to
6
+ms.topic: overview
87
ms.date: 03/04/2025
9
−
108
ms.author: justinha
119
author: vimrang
1210
manager: dougeby
⋯ 1 unchanged line
1412
ms.custom: has-adal-ref
1513
---
1614
17
−# Overview of Microsoft Entra certificate-based authentication
15
+# What is Microsoft Entra certificate-based authentication?
1816
19
−Microsoft Entra certificate-based authentication (CBA) enables customers to allow or require users to authenticate directly with X.509 certificates against their Microsoft Entra ID for applications and browser sign-in.
20
−This feature enables customers to adopt a phishing resistant authentication and authenticate with an X.509 certificate against their Public Key Infrastructure (PKI).
17
+Your organization can use Microsoft Entra certificate-based authentication (CBA) to allow or require users to authenticate directly by using X.509 certificates authenticated in Microsoft Entra ID for application and browser sign-in.
2118
19
+Use the feature to adopt a phishing-resistant authentication and to authenticate by using X.509 certificates against your public key infrastructure (PKI).
20
+
2221
<a name='what-is-azure-ad-cba'></a>
2322
2423
## What is Microsoft Entra CBA?
2524
26
−Before cloud-managed support for CBA to Microsoft Entra ID, customers had to implement federated certificate-based authentication, which requires deploying Active Directory Federation Services (AD FS) to be able to authenticate using X.509 certificates against Microsoft Entra ID. With Microsoft Entra certificate-based authentication, customers can authenticate directly against Microsoft Entra ID and eliminate the need for federated AD FS, with simplified customer environments and cost reduction.
27
−
28
−The following images show how Microsoft Entra CBA simplifies the customer environment by eliminating federated AD FS.
25
+Before cloud-managed support for CBA to Microsoft Entra ID was available, an organization had to implement federated CBA for users to authenticate by using X.509 certificates against Microsoft Entra ID. It included deploying Active Directory Federation Services (AD FS). With Microsoft Entra CBA, you can authenticate directly against Microsoft Entra ID and eliminate the need for federated AD FS, for a simplified environment and cost reduction.
2926
30
−**Certificate-based authentication with federated AD FS**
27
+The next figures show how Microsoft Entra CBA simplifies your environment by eliminating federated AD FS.
3128
32
−:::image type="content" border="false" source="./media/concept-certificate-based-authentication/cert-with-federation.png" alt-text="Diagram of certificate-based authentication with federation.":::
29
+### CBA with federated AD FS
3330
34
−**Microsoft Entra certificate-based authentication**
31
+:::image type="content" border="false" source="./media/concept-certificate-based-authentication/cert-with-federation.png" alt-text="Diagram that shows of CBA with federation.":::
3532
36
−:::image type="content" border="false" source="./media/concept-certificate-based-authentication/cloud-native-cert.png" alt-text="Diagram of Microsoft Entra certificate-based authentication.":::
33
+### Microsoft Entra CBA
3734
35
+:::image type="content" border="false" source="./media/concept-certificate-based-authentication/cloud-native-cert.png" alt-text="Diagram that shows Microsoft Entra CBA.":::
3836
3937
<a name='key-benefits-of-using-azure-ad-cba'></a>
4038
4139
## Key benefits of using Microsoft Entra CBA
4240
43
−| Benefits | Description |
41
+| Benefit | Description |
4442
|---------|---------|
45
−| Great user experience |- Users who need certificate-based authentication can now directly authenticate against Microsoft Entra ID and not have to invest in federated AD FS.<br>- Portal UI enables users to easily configure how to map certificate fields to a user object attribute to look up the user in the tenant ([certificate username bindings](concept-certificate-based-authentication-technical-deep-dive.md#understanding-the-username-binding-policy))<br>- Portal UI to [configure authentication policies](concept-certificate-based-authentication-technical-deep-dive.md#understanding-the-authentication-binding-policy) to help determine which certificates are single-factor versus multifactor. |
46
−| Easy to deploy and administer |- Microsoft Entra CBA is a free feature, and you don't need any paid editions of Microsoft Entra ID to use it. <br>- No need for complex on-premises deployments or network configuration.<br>- Directly authenticate against Microsoft Entra ID. |
47
−| Secure |- On-premises passwords don't need to be stored in the cloud in any form.<br>- Protects your user accounts by working seamlessly with Microsoft Entra Conditional Access policies, including Phishing-Resistant [multifactor authentication](concept-mfa-howitworks.md) (MFA requires [licensed edition](concept-mfa-licensing.md)) and blocking legacy authentication.<br>- Strong authentication support where users can define authentication policies through the certificate fields, such as issuer or policy OID (object identifiers), to determine which certificates qualify as single-factor versus multifactor.<br>- The feature works seamlessly with [Conditional Access features](~/identity/conditional-access/overview.md) and authentication strength capability to enforce MFA to help secure your users. |
48
−
43
+| Improved user experience |- Users who need CBA can now directly authenticate against Microsoft Entra ID and not have to invest in federated AD FS.<br>- You can use the admin center to easily map certificate fields to user object attributes to look up the user in the tenant ([certificate username bindings](concept-certificate-based-authentication-technical-deep-dive.md#username-binding-policy))<br>- Use the admin center to [configure authentication policies](concept-certificate-based-authentication-technical-deep-dive.md#authentication-binding-policy) to help determine which certificates are single-factor versus multifactor. |
44
+| Easy to deploy and administer |- Microsoft Entra CBA is a free feature. You don't need any paid editions of Microsoft Entra ID to use it. <br>- No need for complex on-premises deployments or network configuration.<br>- Directly authenticate against Microsoft Entra ID. |
45
+| Secure |- On-premises passwords don't need to be stored in the cloud in any form.<br>- Protects your user accounts by working seamlessly with Microsoft Entra Conditional Access policies, including phishing-resistant [multifactor authentication (MFA)](concept-mfa-howitworks.md). MFA requires a [licensed edition](concept-mfa-licensing.md) and blocking legacy authentication.<br>- Strong authentication support. Admins can define authentication policies through the certificate fields, such as issuer or policy object identifier (policy OID), to determine which certificates qualify as single-factor versus multifactor.<br>- The feature works seamlessly with [Conditional Access features](~/identity/conditional-access/overview.md) and authentication strength capability to enforce MFA to help secure your users. |
4946
5047
## Supported scenarios
5148
5249
The following scenarios are supported:
5350
54
−- User sign-ins to web browser-based applications on all platforms.
55
−- User sign-ins to Office mobile apps on iOS/Android platforms as well as Office native apps in Windows, including Outlook, OneDrive, and so on.
56
−- User sign-ins on mobile native browsers.
57
−- Support for granular authentication rules for multifactor authentication by using the certificate issuer **Subject** and **policy OIDs**.
58
−- Configuring certificate-to-user account bindings by using any of the certificate fields:
59
− - Subject Alternate Name (SAN) PrincipalName and SAN RFC822Name
60
− - Subject Key Identifier (SKI) and SHA1PublicKey
61
− - Issuer + Subject, Subject and Issuer + SerialNumber
62
−- Configuring certificate-to-user account bindings by using any of the user object attributes:
63
− - User Principal Name
64
− - onPremisesUserPrincipalName
65
− - CertificateUserIds
51
+- User sign-ins to web browser-based applications on all platforms
52
+- User sign-ins to Office mobile apps on iOS and Android platforms, and Office native apps in Windows, including Outlook and OneDrive
53
+- User sign-ins on mobile native browsers
54
+- Granular authentication rules for MFA by using the certificate issuer subject and Policy OID
55
+- Certificate-to-user account bindings by using any of the certificate fields:
6656
57
+ - `SubjectAlternativeName` (`SAN`), `PrincipalName`, and `RFC822Name`
58
+ - `SubjectKeyIdentifier` (`SKI`) and `SHA1PublicKey`
59
+ - `IssuerAndSubject` and `IssuerAndSerialNumber`
60
+
61
+- Ccertificate-to-user account bindings by using any of the user object attributes:
62
+ - `userPrincipalName`
63
+ - `onPremisesUserPrincipalName`
64
+ - `certificateUserIds`
65
+
6766
## Unsupported scenarios
6867
6968
The following scenarios aren't supported:
7069
71
−- Certificate Authority hints aren't supported, so the list of certificates that appears for users in the certificate picker UI isn't scoped.
72
−- Only one CRL Distribution Point (CDP) for a trusted CA is supported.
73
−- The CDP can be only HTTP URLs. We don't support Online Certificate Status Protocol (OCSP), or Lightweight Directory Access Protocol (LDAP) URLs.
74
−- Password as an authentication method can't be disabled and the option to sign in using a password is displayed even with Microsoft Entra CBA method available to the user.
70
+- Certificate authority (CA) hints aren't supported. The list of certificates that appears for users in the certificate picker UI isn't scoped.
71
+- Only one CRL distribution point (CDP) for a trusted CA is supported.
72
+- The CDP can be only HTTP URLs. We don't support Online Certificate Status Protocol (OCSP) or Lightweight Directory Access Protocol (LDAP) URLs.
73
+- Password as an authentication method can't be turned off. The option to sign in by using a password appears, even when the Microsoft Entra CBA method is available to the user.
7574
76
−## Known Limitation with Windows Hello For Business certificates
75
+## Known limitation with Windows Hello for Business certificates
7776
78
−- While Windows Hello For Business (WHFB) can be used for multifactor authentication in Microsoft Entra ID, WHFB isn't supported for fresh MFA. Customers can choose to enroll certificates for your users using the WHFB key pair. When properly configured, these WHFB certificates can be used for multifactor authentication in Microsoft Entra ID. WHFB certificates are compatible with Microsoft Entra certificate-based authentication (CBA) in Microsoft Edge and Chrome browsers; however, at this time WHFB certificates aren't compatible with Microsoft Entra CBA in non-browser scenarios (such as Office 365 applications). The workaround is to use the "Sign in Windows Hello or security key" option to sign in (when available) as this option doesn't use certificates for authentication and avoids the issue with Microsoft Entra CBA; however, this option may not be available in some older applications.
77
+Although Windows Hello for Business can be used for MFA in Microsoft Entra ID, Windows Hello for Business isn't supported for fresh MFA. You can choose to enroll certificates for your users by using the Windows Hello for Business key/pair. When properly configured, Windows Hello for Business certificates can be used for MFA in Microsoft Entra ID.
7978
80
−## Out of Scope
79
+Windows Hello for Business certificates are compatible with Microsoft Entra CBA in Microsoft Edge and Chrome browsers. Currently, Windows Hello for Business certificates aren't compatible with Microsoft Entra CBA in nonbrowser scenarios, such as in Office 365 applications. A resolution is to use the **Sign in Windows Hello or security key** option to sign in (when it's available). This option doesn't use certificates for authentication and avoids the issue with Microsoft Entra CBA. The option might not be available in some earlier applications.
8180
81
+## Out of scope
82
+
8283
The following scenarios are out of scope for Microsoft Entra CBA:
8384
84
−- Public Key Infrastructure for creating client certificates. Customers need to configure their own Public Key Infrastructure (PKI) and provision certificates to their users and devices.
85
+- Creating or providing a public key infrastructure (PKI) for creating client certificates. You must configure your own PKI and provision certificates to your users and devices.
8586
86
−## Next steps
87
+## Related content
8788
88
−- [Technical deep dive for Microsoft Entra CBA](concept-certificate-based-authentication-technical-deep-dive.md)
89
−- [How to configure Microsoft Entra CBA](how-to-certificate-based-authentication.md)
89
+- [Microsoft Entra CBA technical concepts](concept-certificate-based-authentication-technical-deep-dive.md)
90
+- [Set up Microsoft Entra CBA](how-to-certificate-based-authentication.md)
9091
- [Microsoft Entra CBA on iOS devices](concept-certificate-based-authentication-mobile-ios.md)
9192
- [Microsoft Entra CBA on Android devices](concept-certificate-based-authentication-mobile-android.md)
92
−- [Windows smart card sign in using Microsoft Entra CBA](concept-certificate-based-authentication-smartcard.md)
93
+- [Windows smart card sign in by using Microsoft Entra CBA](concept-certificate-based-authentication-smartcard.md)
9394
- [Certificate user IDs](concept-certificate-based-authentication-certificateuserids.md)
94
−- [How to migrate federated users](concept-certificate-based-authentication-migration.md)
95
+- [Migrate federated users](concept-certificate-based-authentication-migration.md)
9596
- [FAQ](certificate-based-authentication-faq.yml)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:46 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.