Certificate-based authentication requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5ab4955 · +1 −1 lines · also on GitHub
⋯ 60 unchanged lines
6161
- Configuring certificate-to-user account bindings by using any of the certificate fields:
6262
- Subject Alternate Name (SAN) PrincipalName and SAN RFC822Name
6363
- Subject Key Identifier (SKI) and SHA1PublicKey
64
+ - Issuer + Subject, Subject and Issuer + SerialNumber
6465
- Configuring certificate-to-user account bindings by using any of the user object attributes:
6566
- User Principal Name
6667
- onPremisesUserPrincipalName
⋯ 6 unchanged lines
7374
- Certificate Authority hints aren't supported, so the list of certificates that appears for users in the certificate picker UI isn't scoped.
7475
- Only one CRL Distribution Point (CDP) for a trusted CA is supported.
7576
- The CDP can be only HTTP URLs. We don't support Online Certificate Status Protocol (OCSP), or Lightweight Directory Access Protocol (LDAP) URLs.
76
−- Configuring other certificate-to-user account bindings, such as using the **Subject**, **Subject + Issuer**, or **Issuer + Serial Number**, aren’t available in this release.
7777
- Password as an authentication method cannot be disabled and the option to sign in using a password is displayed even with Microsoft Entra CBA method available to the user.
7878
7979
## Known Limitation with Windows Hello For Business certificates
⋯ 19 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:46 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.