Custom Conditional Access authentication strengths

This page's changes and edits · All guidance changes

Microsoft's edit · 16 Oct 2025 23:10 UTC

edit pass: conditional-access-authentication-strength

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5ab71eb · +5 −5 lines · also on GitHub

⋯ 83 unchanged lines

8484

8585 1. Select or enter the certificate issuers, and enter the allowed policy OIDs.

8686

87 − You can configure certificate issuers by selecting them in the **Certificate issuers from the certificate authorities in your tenant** dropdown list. The dropdown menu lists all certificate authorities from the tenant, whether they're single-factor or multifactor.

87 + You can configure certificate issuers by selecting them in the **Certificate issuers from the certificate authorities in your tenant** dropdown list. The dropdown list shows all certificate authorities from the tenant, whether they're single-factor or multifactor.

8888

8989 For scenarios where the certificate that you want to use is not uploaded to the certificate authorities in your tenant, you can enter certificate issuers in the **Other Certificate Issuers by SubjectkeyIdentifier** box. One such example is external user scenarios, where the user could be authenticating in the home tenant and the authentication strength is being enforced on the resource tenant.

9090

⋯ 59 unchanged lines

150150

151151 ### Advanced options for passkeys (FIDO2)

152152

153 −Advanced options for passkeys (FIDO2) aren't supported for external users whose home tenant and resource tenant are located in different Microsoft cloud services.

153 +Advanced options for passkeys (FIDO2) aren't supported for external users whose home tenant and resource tenant are located in different Microsoft clouds.

154154

155155 ### Advanced options for certificate-based authentication

156156

⋯ 10 unchanged lines

167167

168168 - For business-to-business users, let's take an example where Contoso invites users from another organization (Fabrikam) to its tenant. In this case, Contoso is the resource tenant and Fabrikam is the home tenant. Access depends on the cross-tenant access setting:

169169 - When the cross-tenant access setting is **Off**, it means Contoso doesn't accept MFA that the home tenant performed. Certificate-based authentication on the resource tenant isn't supported.

170 − - When cross-tenant access setting is **On**, Fabrikam and Contoso tenants are on the same Microsoft cloud service (the Azure commercial cloud platform or the Azure for US Government cloud platform). In addition, Contoso trusts MFA that was performed on the home tenant. In this case:

170 + - When cross-tenant access setting is **On**, Fabrikam and Contoso tenants are on the same Microsoft cloud (the Azure commercial cloud platform or the Azure for US Government cloud platform). In addition, Contoso trusts MFA that was performed on the home tenant. In this case:

171171 - The admin can restrict access to a specific resource by using the policy OIDs or the **Other Certificate Issuers by SubjectkeyIdentifier** setting in the custom authentication strength policy.

172172 - The admin can restrict access to specific resources by using the **Other Certificate Issuers by SubjectkeyIdentifier** setting in the custom authentication strength policy.

173 − - When the cross-tenant access setting is **On**, Fabrikam and Contoso aren't on the same Microsoft cloud service. For example, Fabrikam's tenant is on the Azure commercial cloud platform and Contoso's tenant is on the Azure for US Government cloud platform. The admin can't restrict access to specific resources by using the issuer ID or policy OIDs in the custom authentication strength policy.

173 + - When the cross-tenant access setting is **On**, Fabrikam and Contoso aren't on the same Microsoft cloud. For example, Fabrikam's tenant is on the Azure commercial cloud platform and Contoso's tenant is on the Azure for US Government cloud platform. The admin can't restrict access to specific resources by using the issuer ID or policy OIDs in the custom authentication strength policy.

174174

175175 ## Troubleshoot advanced options for authentication strengths

176176

⋯ 3 unchanged lines

180180

181181 :::image type="content" border="true" source="./media/troubleshoot-authentication-strengths/restricted-security-key.png" alt-text="Screenshot of a sign-in error when a user is using a restricted passkey.":::

182182

183 −### You need to check certificate issuer or policy OID

183 +### You need to check the certificate issuer or policy OID

184184

185185 You can confirm that the personal certificate properties match the configuration in the advanced options for authentication strengths:

186186

⋯ 13 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.