Certificate-based authentication requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit f9bc4d0 · +3 −3 lines · also on GitHub
⋯ 70 unchanged lines
7171
- Certificate Authority hints aren't supported, so the list of certificates that appears for users in the certificate picker UI isn't scoped.
7272
- Only one CRL Distribution Point (CDP) for a trusted CA is supported.
7373
- The CDP can be only HTTP URLs. We don't support Online Certificate Status Protocol (OCSP), or Lightweight Directory Access Protocol (LDAP) URLs.
74
−- Password as an authentication method cannot be disabled and the option to sign in using a password is displayed even with Microsoft Entra CBA method available to the user.
74
+- Password as an authentication method can't be disabled and the option to sign in using a password is displayed even with Microsoft Entra CBA method available to the user.
7575
7676
## Known Limitation with Windows Hello For Business certificates
7777
78
−- While Windows Hello For Business (WHFB) can be used for multi-factor authentication in Microsoft Entra ID, WHFB is not supported for fresh MFA. Customers may choose to enroll certificates for your users using the WHFB key pair. When properly configured, these WHFB certificates can be used for multi-factor authentication in Microsoft Entra ID. WHFB certificates are compatible with Microsoft Entra certificate-based authentication (CBA) in Edge and Chrome browsers; however, at this time WHFB certificates are not compatible with Microsoft Entra CBA in non-browser scenarios (such as Office 365 applications). The workaround is to use the "Sign in Windows Hello or security key" option to sign in (when available) as this option does not use certificates for authentication and avoids the issue with Microsoft Entra CBA; however, this option may not be available in some older applications.
78
+- While Windows Hello For Business (WHFB) can be used for multifactor authentication in Microsoft Entra ID, WHFB isn't supported for fresh MFA. Customers can choose to enroll certificates for your users using the WHFB key pair. When properly configured, these WHFB certificates can be used for multifactor authentication in Microsoft Entra ID. WHFB certificates are compatible with Microsoft Entra certificate-based authentication (CBA) in Microsoft Edge and Chrome browsers; however, at this time WHFB certificates aren't compatible with Microsoft Entra CBA in non-browser scenarios (such as Office 365 applications). The workaround is to use the "Sign in Windows Hello or security key" option to sign in (when available) as this option doesn't use certificates for authentication and avoids the issue with Microsoft Entra CBA; however, this option may not be available in some older applications.
7979
8080
## Out of Scope
8181
⋯ 7 unchanged lines
8989
- [How to configure Microsoft Entra CBA](how-to-certificate-based-authentication.md)
9090
- [Microsoft Entra CBA on iOS devices](concept-certificate-based-authentication-mobile-ios.md)
9191
- [Microsoft Entra CBA on Android devices](concept-certificate-based-authentication-mobile-android.md)
92
−- [Windows smart card logon using Microsoft Entra CBA](concept-certificate-based-authentication-smartcard.md)
92
+- [Windows smart card sign in using Microsoft Entra CBA](concept-certificate-based-authentication-smartcard.md)
9393
- [Certificate user IDs](concept-certificate-based-authentication-certificateuserids.md)
9494
- [How to migrate federated users](concept-certificate-based-authentication-migration.md)
9595
- [FAQ](certificate-based-authentication-faq.yml)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:46 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.