Custom Conditional Access authentication strengths

This page's changes and edits · All guidance changes

Microsoft's edit · 11 Mar 2025 23:35 UTC

Update concept-authentication-strength-advanced-options.md

Microsoft's commit message in MicrosoftDocs/entra-docs · commit b2f6d6f · +7 −5 lines · also on GitHub

⋯ 63 unchanged lines

6464

6565 :::image type="content" border="true" source="./media/concept-authentication-strength-advanced-options/certificate-advanced-options.png" alt-text="Screenshot showing Advanced options for certificate-based authentication.":::

6666

67 −1. You can select certificate issuers from the drop-down menu, type the certificate issuers and type the allowed policy OIDs. The drop-down menu lists all certificate authorities from the tenant irrespective of whether they're single-factor or multifactor.

67 +1. You can select certificate issuers from the drop-down menu, type the certificate issuers and type the allowed policy OIDs. The drop-down menu lists all certificate authorities from the tenant irrespective of whether they're single-factor or multifactor. Certificate issuers can be configured either by using the drop down **Certificate issuers from the certificate authorities in your tenant** or by using **Other certificate issuer by SubjectkeyIdentifier** for scenarios where the certificate you would like to use is not uploaded to the Certificate authorities in your tenant. One such example is external user scenarios, where the user could be authenticating in their home tenant and auth strength is being enforced on the resource tenant.

6868

6969 :::image type="content" border="true" source="./media/concept-authentication-strength-advanced-options/or-other-issuer.png" alt-text="Screenshot showing the configuration options - certificate issuers from the drop-down menu, type the certificate issuers and type the allowed policy OIDs .":::

7070

71 − - If both **Allowed certificate issuer** AND **Allowed Policy OID** are configured, there's a AND relationship. The user has to use a certificate that satisfies both conditions.

72 − - Between the **Allowed certificate issuer** list and the **Allowed Policy OID** list, there's an OR relationship. The user has to use a certificate that satisfied one of the issuers or policy OIDs.

73 − - Use **Other certificate issuer by SubjectkeyIdentifier** if the certificate you would like to use is not uploaded to the **Certificate authorities** in your tenant. This setting can be used for external user scenarios, if the user is authenticating in their home tenant.

71 + - If both attributes Certificate issuers AND Policy OIDs are configured, there's a AND relationship and the user has to use a certificate that has atleast one of the issuers AND one of the policy OID from the list to satisfy the authentication strength.

72 + - If only Certificate issuers attribute is configured then the user has to use a certificate that has atleast one of the issuers to satisfy the authentication strength .

73 + - If only Policy OIDs attribute is configured then the user has to use a certificate that has atleast one of the policy OIDs to satisfy the authentication strength.

7474

75 −1. Click **Next** to review the configuration, then click **Create**.

75 + >[!NOTE]

76 + > We allow a max of 5 issuers and 5 OIDs to be configured in authentication strengths configuration.

7677

78 +1. Click **Next** to review the configuration, then click **Create**.

7779

7880 ### Microsoft Graph

7981

⋯ 88 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.