Certificate-based authentication requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 2d7589c · +25 −21 lines · also on GitHub
11
---
2
−title: Overview of Azure AD certificate-based authentication
3
−description: Learn about Azure AD certificate-based authentication without federation
2
+title: Overview of Microsoft Entra certificate-based authentication
3
+description: Learn about Microsoft Entra certificate-based authentication without federation
44
55
services: active-directory
66
ms.service: active-directory
⋯ 10 unchanged lines
1717
ms.custom: has-adal-ref
1818
---
1919
20
−# Overview of Azure AD certificate-based authentication
20
+# Overview of Microsoft Entra certificate-based authentication
2121
22
−Azure AD certificate-based authentication (CBA) enables customers to allow or require users to authenticate directly with X.509 certificates against their Azure Active Directory (Azure AD) for applications and browser sign-in.
22
+Microsoft Entra certificate-based authentication (CBA) enables customers to allow or require users to authenticate directly with X.509 certificates against their Microsoft Entra ID for applications and browser sign-in.
2323
This feature enables customers to adopt a phishing resistant authentication and authenticate with an X.509 certificate against their Public Key Infrastructure (PKI).
2424
25
−## What is Azure AD CBA?
25
+<a name='what-is-azure-ad-cba'></a>
2626
27
−Before cloud-managed support for CBA to Azure AD, customers had to implement federated certificate-based authentication, which requires deploying Active Directory Federation Services (AD FS) to be able to authenticate using X.509 certificates against Azure AD. With Azure AD certificate-based authentication, customers can authenticate directly against Azure AD and eliminate the need for federated AD FS, with simplified customer environments and cost reduction.
27
+## What is Microsoft Entra CBA?
2828
29
−The following images show how Azure AD CBA simplifies the customer environment by eliminating federated AD FS.
29
+Before cloud-managed support for CBA to Microsoft Entra ID, customers had to implement federated certificate-based authentication, which requires deploying Active Directory Federation Services (AD FS) to be able to authenticate using X.509 certificates against Microsoft Entra ID. With Microsoft Entra certificate-based authentication, customers can authenticate directly against Microsoft Entra ID and eliminate the need for federated AD FS, with simplified customer environments and cost reduction.
3030
31
+The following images show how Microsoft Entra CBA simplifies the customer environment by eliminating federated AD FS.
32
+
3133
**Certificate-based authentication with federated AD FS**
3234
3335
:::image type="content" border="false" source="./media/concept-certificate-based-authentication/cert-with-federation.png" alt-text="Diagram of certificate-based authentication with federation.":::
3436
35
−**Azure AD certificate-based authentication**
37
+**Microsoft Entra certificate-based authentication**
3638
37
−:::image type="content" border="false" source="./media/concept-certificate-based-authentication/cloud-native-cert.png" alt-text="Diagram of Azure AD certificate-based authentication.":::
39
+:::image type="content" border="false" source="./media/concept-certificate-based-authentication/cloud-native-cert.png" alt-text="Diagram of Microsoft Entra certificate-based authentication.":::
3840
3941
40
−## Key benefits of using Azure AD CBA
42
+<a name='key-benefits-of-using-azure-ad-cba'></a>
4143
44
+## Key benefits of using Microsoft Entra CBA
45
+
4246
| Benefits | Description |
4347
|---------|---------|
44
−| Great user experience |- Users who need certificate-based authentication can now directly authenticate against Azure AD and not have to invest in federated AD FS.<br>- Portal UI enables users to easily configure how to map certificate fields to a user object attribute to look up the user in the tenant ([certificate username bindings](concept-certificate-based-authentication-technical-deep-dive.md#understanding-the-username-binding-policy))<br>- Portal UI to [configure authentication policies](concept-certificate-based-authentication-technical-deep-dive.md#understanding-the-authentication-binding-policy) to help determine which certificates are single-factor versus multifactor. |
45
−| Easy to deploy and administer |- Azure AD CBA is a free feature, and you don't need any paid editions of Azure AD to use it. <br>- No need for complex on-premises deployments or network configuration.<br>- Directly authenticate against Azure AD. |
46
−| Secure |- On-premises passwords don't need to be stored in the cloud in any form.<br>- Protects your user accounts by working seamlessly with Azure AD Conditional Access policies, including Phishing-Resistant [multifactor authentication](concept-mfa-howitworks.md) (MFA requires [licensed edition](concept-mfa-licensing.md)) and blocking legacy authentication.<br>- Strong authentication support where users can define authentication policies through the certificate fields, such as issuer or policy OID (object identifiers), to determine which certificates qualify as single-factor versus multifactor.<br>- The feature works seamlessly with [Conditional Access features](../conditional-access/overview.md) and authentication strength capability to enforce MFA to help secure your users. |
48
+| Great user experience |- Users who need certificate-based authentication can now directly authenticate against Microsoft Entra ID and not have to invest in federated AD FS.<br>- Portal UI enables users to easily configure how to map certificate fields to a user object attribute to look up the user in the tenant ([certificate username bindings](concept-certificate-based-authentication-technical-deep-dive.md#understanding-the-username-binding-policy))<br>- Portal UI to [configure authentication policies](concept-certificate-based-authentication-technical-deep-dive.md#understanding-the-authentication-binding-policy) to help determine which certificates are single-factor versus multifactor. |
49
+| Easy to deploy and administer |- Microsoft Entra CBA is a free feature, and you don't need any paid editions of Microsoft Entra ID to use it. <br>- No need for complex on-premises deployments or network configuration.<br>- Directly authenticate against Microsoft Entra ID. |
50
+| Secure |- On-premises passwords don't need to be stored in the cloud in any form.<br>- Protects your user accounts by working seamlessly with Microsoft Entra Conditional Access policies, including Phishing-Resistant [multifactor authentication](concept-mfa-howitworks.md) (MFA requires [licensed edition](concept-mfa-licensing.md)) and blocking legacy authentication.<br>- Strong authentication support where users can define authentication policies through the certificate fields, such as issuer or policy OID (object identifiers), to determine which certificates qualify as single-factor versus multifactor.<br>- The feature works seamlessly with [Conditional Access features](../conditional-access/overview.md) and authentication strength capability to enforce MFA to help secure your users. |
4751
4852
4953
## Supported scenarios
⋯ 20 unchanged lines
7074
- Only one CRL Distribution Point (CDP) for a trusted CA is supported.
7175
- The CDP can be only HTTP URLs. We don't support Online Certificate Status Protocol (OCSP), or Lightweight Directory Access Protocol (LDAP) URLs.
7276
- Configuring other certificate-to-user account bindings, such as using the **Subject**, **Subject + Issuer** or **Issuer + Serial Number**, aren’t available in this release.
73
−- Password as an authentication method cannot be disabled and the option to sign in using a password is displayed even with Azure AD CBA method available to the user.
77
+- Password as an authentication method cannot be disabled and the option to sign in using a password is displayed even with Microsoft Entra CBA method available to the user.
7478
7579
## Known Limitation with Windows Hello For Business certificates
7680
77
−- While Windows Hello For Business (WHFB) can be used for multi-factor authentication in Azure AD, WHFB is not supported for fresh MFA. Customers may choose to enroll certificates for your users using the WHFB key pair. When properly configured, these WHFB certificates can be used for multi-factor authentication in Azure AD. WHFB certificates are compatible with Azure AD certificate-based authentication (CBA) in Edge and Chrome browsers; however, at this time WHFB certificates are not compatible with Azure AD CBA in non-browser scenarios (e.g. Office 365 applications). The workaround is to use the "Sign in Windows Hello or security key" option to sign in (when available) as this option does not use certificates for authentication and avoids the issue with Azure AD CBA; however, this option may not be available in some older applications.
81
+- While Windows Hello For Business (WHFB) can be used for multi-factor authentication in Microsoft Entra ID, WHFB is not supported for fresh MFA. Customers may choose to enroll certificates for your users using the WHFB key pair. When properly configured, these WHFB certificates can be used for multi-factor authentication in Microsoft Entra ID. WHFB certificates are compatible with Microsoft Entra certificate-based authentication (CBA) in Edge and Chrome browsers; however, at this time WHFB certificates are not compatible with Microsoft Entra CBA in non-browser scenarios (e.g. Office 365 applications). The workaround is to use the "Sign in Windows Hello or security key" option to sign in (when available) as this option does not use certificates for authentication and avoids the issue with Microsoft Entra CBA; however, this option may not be available in some older applications.
7882
7983
## Out of Scope
8084
81
−The following scenarios are out of scope for Azure AD CBA:
85
+The following scenarios are out of scope for Microsoft Entra CBA:
8286
8387
- Public Key Infrastructure for creating client certificates. Customers need to configure their own Public Key Infrastructure (PKI) and provision certificates to their users and devices.
8488
8589
## Next steps
8690
87
−- [Technical deep dive for Azure AD CBA](concept-certificate-based-authentication-technical-deep-dive.md)
88
−- [How to configure Azure AD CBA](how-to-certificate-based-authentication.md)
89
−- [Azure AD CBA on iOS devices](concept-certificate-based-authentication-mobile-ios.md)
90
−- [Azure AD CBA on Android devices](concept-certificate-based-authentication-mobile-android.md)
91
−- [Windows smart card logon using Azure AD CBA](concept-certificate-based-authentication-smartcard.md)
91
+- [Technical deep dive for Microsoft Entra CBA](concept-certificate-based-authentication-technical-deep-dive.md)
92
+- [How to configure Microsoft Entra CBA](how-to-certificate-based-authentication.md)
93
+- [Microsoft Entra CBA on iOS devices](concept-certificate-based-authentication-mobile-ios.md)
94
+- [Microsoft Entra CBA on Android devices](concept-certificate-based-authentication-mobile-android.md)
95
+- [Windows smart card logon using Microsoft Entra CBA](concept-certificate-based-authentication-smartcard.md)
9296
- [Certificate user IDs](concept-certificate-based-authentication-certificateuserids.md)
9397
- [How to migrate federated users](concept-certificate-based-authentication-migration.md)
9498
- [FAQ](certificate-based-authentication-faq.yml)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:46 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.