Custom Conditional Access authentication strengths
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit d25b489 · +83 −55 lines · also on GitHub
11
---
2
−title: Overview of custom authentication strengths and advanced options for passkey (FIDO2) and certificate-based authentication in Microsoft Entra ID
2
+title: Create and Manage Custom Conditional Access Authentication Strengths
33
description: Learn how admins can create custom authentication strengths with advanced options for passkey (FIDO2) security keys and certificate-based authentication.
44
ms.service: entra-id
55
ms.subservice: authentication
6
−ms.topic: article
6
+ms.topic: how-to
77
ms.date: 09/15/2025
88
ms.author: justinha
99
author: inbarckms
⋯ 1 unchanged line
1111
ms.reviewer: inbarc
1212
ms.custom: sfi-image-nochange
1313
---
14
−# Custom Conditional Access authentication strengths
1514
16
−Administrators can also create up to 15 of their own custom authentication strengths to exactly suit their requirements. A custom authentication strength can contain any of the supported combinations in the preceding table.
15
+# Create and manage custom Conditional Access authentication strengths
1716
17
+An authentication strength is a Microsoft Entra Conditional Access control that specifies combinations of authentication methods for access to a resource. As an administrator, you can create up to 15 custom authentication strengths to exactly suit your requirements.
18
+
19
+## Prerequisites
20
+
21
+- To use Conditional Access, your tenant needs to have Microsoft Entra ID P1 license. If you don't have this license, you can start a [free trial](https://www.microsoft.com/security/business/get-started/start-free-trial).
22
+
23
+## Create a custom authentication strength
24
+
1825
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Security Administrator](~/identity/role-based-access-control/permissions-reference.md#security-administrator).
26
+
1927
1. Browse to **Entra ID** > **Authentication methods** > **Authentication strengths**.
28
+
2029
1. Select **New authentication strength**.
21
−1. Provide a descriptive **Name** for your new authentication strength.
22
−1. Optionally provide a **Description**.
23
−1. Select the available methods you want to allow, like those under Phishing-resistant MFA, Passwordless MFA, and Temporary Access Pass.
24
−1. Choose **Next** and review the policy configuration.
2530
26
− :::image type="content" border="true" source="media/concept-authentication-strengths/authentication-strength-custom.png" alt-text="Screenshot showing the creation of a custom authentication strength.":::
31
+1. For **Name**, provide a descriptive name for your new authentication strength.
2732
28
−#### Update and delete custom authentication strengths
33
+1. For **Description**, you can provide an optional description.
2934
30
−You can edit a custom authentication strength. If it's referenced by a Conditional Access policy, it can't be deleted, and you need to confirm any edit.
31
−To check if an authentication strength is referenced by a Conditional Access policy, click the **Conditional Access policies** column.
35
+1. Select the available methods that you want to allow, like those under **Phishing-resistant MFA**, **Passwordless MFA**, and **Temporary Access Pass**.
3236
37
+1. Select **Next** and review the policy configuration.
3338
34
−## Passkey (FIDO2) advanced options
35
−You can restrict the usage of passkeys (FIDO2) based on their Authenticator Attestation GUIDs (AAGUIDs). This capability allows administrators to require a FIDO2 security key from a specific manufacturer in order to access the resource. To require a specific FIDO2 security key, first create a custom authentication strength. Then select **Passkeys (FIDO2)**, and click **Advanced options**.
39
+:::image type="content" border="true" source="media/concept-authentication-strengths/authentication-strength-custom.png" alt-text="Screenshot that shows the creation of a custom authentication strength.":::
3640
37
−:::image type="content" border="true" source="./media/concept-authentication-strengths/key.png" alt-text="Screenshot showing Advanced options for passkey (FIDO2).":::
41
+## Update and delete custom authentication strengths
3842
39
−Next to **Add AAGUID**, click **+**, copy the AAGUID value, and click **Save**.
43
+You can edit a custom authentication strength. If a Conditional Access policy references that authentication strength, you can't delete it, and you need to confirm any edit.
4044
41
−:::image type="content" border="true" source="./media/concept-authentication-strengths/guid.png" alt-text="Screenshot showing how to add an Authenticator Attestation GUID.":::
45
+To check if a Conditional Access policy references an authentication strength, go to the **Conditional Access policies** column.
4246
47
+## Configure advanced options for passkeys (FIDO2)
4348
44
−## Certificate-based authentication advanced options
49
+You can restrict the usage of passkeys (FIDO2) based on their Authenticator Attestation GUIDs (AAGUIDs). You can use this capability to require a FIDO2 security key from a specific manufacturer for access to a resource. To require a specific FIDO2 security key:
4550
46
−In the [Authentication methods policy](how-to-certificate-based-authentication.md#step-3-configure-an-authentication-binding-policy), you can configure whether certificates are bound in the system to single-factor or multifactor authentication protection levels, based on the certificate issuer or policy OID. You can also require single-factor or multifactor authentication certificates for specific resources, based on Conditional Access authentication strength policy.
51
+1. After you create a custom authentication strength, select **Passkeys (FIDO2)** > **Advanced options**.
4752
48
−By using authentication strength advanced options, you can require a specific certificate issuer or policy OID to further restrict sign-ins to an application.
53
+ :::image type="content" border="true" source="./media/concept-authentication-strengths/key.png" alt-text="Screenshot that shows the link for advanced options for passkeys (FIDO2).":::
4954
50
−For example, Contoso issues smart cards to employees with three different types of multifactor certificates. One certificate is for confidential clearance, another for secret clearance, and a third is for top secret clearance. Each one is distinguished by properties of the certificate, such as policy OID or issuer. Contoso wants to ensure that only users with the appropriate multifactor certificate can access data for each classification.
55
+1. Next to **Add AAGUID**, select the plus sign (**+**), copy the AAGUID value, and then select **Save**.
5156
52
−The next sections show how to configure advanced options for CBA by using the Microsoft Entra admin center and Microsoft Graph.
57
+ :::image type="content" border="true" source="./media/concept-authentication-strengths/guid.png" alt-text="Screenshot that shows how to add an Authenticator Attestation GUID.":::
5358
59
+## Configure advanced options for certificate-based authentication
60
+
61
+In the [authentication binding policy](how-to-certificate-based-authentication.md#step-3-configure-an-authentication-binding-policy), you can configure whether certificates are bound in the system to single-factor or multifactor authentication protection levels, based on the object identifier (OID) for the certificate issuer or policy. You can also require single-factor or multifactor authentication certificates for specific resources, based on a Conditional Access authentication strength policy.
62
+
63
+By using advanced options for authentication strength, you can require a specific certificate issuer or policy OID to further restrict sign-ins to an application.
64
+
65
+For example, assume that an organization named Contoso issues smart cards to employees with three different types of multifactor certificates. One certificate is for confidential clearance, another for secret clearance, and a third is for top-secret clearance. Each one is distinguished by properties of the certificate, such as policy OID or issuer. Contoso wants to ensure that only users who have the appropriate multifactor certificate can access data for each classification.
66
+
67
+The next sections show how to configure advanced options for certificate-based authentication (CBA) by using the Microsoft Entra admin center and Microsoft Graph.
68
+
5469
### Microsoft Entra admin center
5570
5671
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as an Administrator.
72
+
5773
1. Browse to **Entra ID** > **Authentication methods** > **Authentication strengths**.
74
+
5875
1. Select **New authentication strength**.
59
−1. Provide a descriptive **Name** for your new authentication strength.
60
−1. Optionally provide a **Description**.
61
−1. Below Certificate-based authentication (either single-factor or multifactor), click **Advanced options**.
6276
63
− :::image type="content" border="true" source="./media/concept-authentication-strength-advanced-options/certificate-advanced-options.png" alt-text="Screenshot showing Advanced options for certificate-based authentication.":::
64
−
65
−1. You can select certificate issuers from the drop-down menu, type the certificate issuers and type the allowed policy OIDs. The drop-down menu lists all certificate authorities from the tenant irrespective of whether they're single-factor or multifactor. Certificate issuers can be configured either by using the drop-down **Certificate issuers from the certificate authorities in your tenant** or by using **Other certificate issuer by SubjectkeyIdentifier** for scenarios where the certificate you would like to use is not uploaded to the Certificate authorities in your tenant. One such example is external user scenarios, where the user could be authenticating in their home tenant and auth strength is being enforced on the resource tenant.
77
+1. For **Name**, provide a descriptive name for your new authentication strength.
6678
67
− :::image type="content" border="true" source="./media/concept-authentication-strength-advanced-options/or-other-issuer.png" alt-text="Screenshot showing the configuration options - certificate issuers from the drop-down menu, type the certificate issuers and type the allowed policy OIDs.":::
79
+1. For **Description**, you can provide an optional description.
6880
69
− - If both attributes Certificate issuers AND Policy OIDs are configured, there's a AND relationship and the user has to use a certificate that has atleast one of the issuers AND one of the policy OID from the list to satisfy the authentication strength.
70
− - If only Certificate issuers attribute is configured then the user has to use a certificate that has atleast one of the issuers to satisfy the authentication strength.
71
− - If only Policy OIDs attribute is configured then the user has to use a certificate that has atleast one of the policy OIDs to satisfy the authentication strength.
81
+1. Below the option for certificate-based authentication (either single-factor or multifactor), select **Advanced options**.
7282
73
− >[!NOTE]
74
− > We allow a max of 5 issuers and 5 OIDs to be configured in authentication strengths configuration.
83
+ :::image type="content" border="true" source="./media/concept-authentication-strength-advanced-options/certificate-advanced-options.png" alt-text="Screenshot that shows the link for advanced options for certificate-based authentication.":::
7584
76
−1. Click **Next** to review the configuration, then click **Create**.
85
+1. Select or enter the certificate issuers, and enter the allowed policy OIDs.
7786
87
+ You can configure certificate issuers either by selecting them in the **Certificate issuers from the certificate authorities in your tenant** dropdown list. The dropdown menu lists all certificate authorities from the tenant,whether they're single-factor or multifactor.
88
+
89
+ You can enter certificate issuers in the **Other Certificate Issuers by SubjectkeyIdentifier** box for scenarios where the certificate that you want to use is not uploaded to the certificate authorities in your tenant. One such example is external user scenarios, where the user could be authenticating in their home tenant and auth strength is being enforced on the resource tenant.
90
+
91
+ :::image type="content" border="true" source="./media/concept-authentication-strength-advanced-options/or-other-issuer.png" alt-text="Screenshot that shows the configuration options for certificate issuers and policy object identifiers.":::
92
+
93
+ These conditions apply:
94
+
95
+ - If you configure both attributes (certificate issuers and policy OIDs), the user must use a certificate that has at least one of the issuers *and* one of the policy OIDs from the list to satisfy the authentication strength.
96
+ - If you configure only the certificate issuers attribute, the user must use a certificate that has at least one of the issuers to satisfy the authentication strength.
97
+ - If you configure only the policy OIDs attribute, the user must use a certificate that has at least one of the policy OIDs to satisfy the authentication strength.
98
+
99
+ > [!NOTE]
100
+ > You can configure a maximum of five issuers and five OIDs for an authentication strength.
101
+
102
+1. Select **Next** to review the configuration, and then select **Create**.
103
+
78104
### Microsoft Graph
79105
80
−To create a new Conditional Access authentication strength policy with certificate combinationConfiguration:
106
+To create a new Conditional Access authentication strength policy by using `combinationConfigurations` for a certificate, use this code:
81107
82108
```json
83109
POST /beta/identity/conditionalAccess/authenticationStrength/policies
⋯ 19 unchanged lines
103129
}
104130
```
105131
106
−To add a new combinationConfiguration to an existing policy:
132
+To add new `combinationConfiguration` information to an existing policy, use this code:
107133
108134
```json
109135
POST beta/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicyId}/combinationConfigurations
⋯ 10 unchanged lines
120146
}
121147
```
122148
123
−## Limitations
149
+## Understand limitations
124150
125
−### Passkeys (FIDO2) Advanced options
126
−- Passkeys (FIDO2) Advanced options - Advanced options aren't supported for external users with a home tenant that is located in a different Microsoft cloud than the resource tenant.
151
+### Advanced options for passkeys (FIDO2)
127152
128
−### Certificate-based authentication advanced options
153
+Advanced options for passkeys (FIDO2) aren't supported for external users whose home tenant and resource tentant are located in a different Microsoft cloud services.
129154
130
−- Only one certificate can be used in each browser session. After you sign in with a certificate, it's cached in the browser for the duration of the session. You won't be prompted to choose another certificate if it doesn’t meet the authentication strength requirements. You need to sign out and sign back in to restart the session. Then choose the relevant certificate.
155
+### Advanced options for certificate-based authentication
131156
132
−- Certificate Authorities and user certificates should conform to the X.509 v3 standard. Specifically, to enforce issuer SKI CBA restrictions, certificates need valid AKIs:
157
+- A user can use only one certificate in each browser session. After the user signs in with a certificate, it's cached in the browser for the duration of the session. The user isn't prompted to choose another certificate if it doesn't meet the authentication strength requirements. The user needs to sign out and sign back in to restart the session, and then choose the relevant certificate.
133158
134
− :::image type="content" border="true" source="./media/concept-authentication-strength-advanced-options/subject-key-identifier.png" alt-text="Screenshot showing an authority key identifier.":::
159
+- Certificate authorities and user certificates should conform to the X.509 v3 standard. Specifically, to enforce CBA restrictions for issuer subject key identifiers (SKIs), certificates need valid authority key identifiers (AKIs).
135160
136
− >[!NOTE]
137
− >If the certificate doesn't conform, user authentication might succeed, but not satisfy the issuerSki restrictions for the authentication strength policy.
161
+ :::image type="content" border="true" source="./media/concept-authentication-strength-advanced-options/subject-key-identifier.png" alt-text="Screenshot that shows an authority key identifier.":::
138162
139
−- During sign-in, the first 5 policy OIDs from the end user certificate are considered, and compared with the policy OIDs configured in the authentication strength policy. If the end user certificate has more than five policy OIDs, the first five policy OIDs in lexical order that match the authentication strength requirements are taken into account.
163
+ > [!NOTE]
164
+ > If the certificate doesn't conform, user authentication might succeed but not satisfy the issuer SKI restrictions for the authentication strength policy.
140165
141
−- For B2B users, let's take an example where Contoso has invited users from Fabrikam to their tenant. In this case, Contoso is the resource tenant and Fabrikam is the home tenant.
166
+- During sign-in, the first five policy OIDs from the end user certificate are considered, and compared with the policy OIDs configured in the authentication strength policy. If the user certificate has more than five policy OIDs, Microsoft Entra ID takes into account the first five policy OIDs (in lexical order) that match the authentication strength requirements.
167
+
168
+- For business-to-business users, let's take an example where Contoso invites users from another organization (Fabrikam) to its tenant. In this case, Contoso is the resource tenant and Fabrikam is the home tenant. Access dependson the cross-tenant access setting:
142169
- When cross-tenant access setting is **Off** (Contoso doesn't accept MFA that was performed by the home tenant) - Using certificate-based authentication on the resource tenant isn't supported.
143170
- When cross-tenant access setting is **On**, Fabrikam and Contoso are on the same Microsoft cloud – meaning, both Fabrikam and Contoso tenants are on the Azure commercial cloud or on the Azure for US Government cloud. In addition, Contoso trusts MFA that was performed on the home tenant. In this case:
144171
- Access to a specific resource can be restricted by using the policy OIDs or the "other certificate issuer by SubjectkeyIdentifier" in the custom authentication strength policy.
145172
- Access to specific resources can be restricted by using the "Other certificate issuer by SubjectkeyIdentifier" setting in the custom authentication strength policy.
146
− - When cross-tenant access setting is **On**, Fabrikam and Contoso aren't on the same Microsoft cloud – for example, Fabrikam’s tenant is on the Azure commercial cloud and Contoso’s tenant is on the Azure for US Government cloud – access to specific resources can't be restricted by using the issuer ID or policy OIDs in the custom authentication strength policy.
173
+ - When cross-tenant access setting is **On**, Fabrikam and Contoso aren't on the same Microsoft cloud – for example, Fabrikam's tenant is on the Azure commercial cloud and Contoso's tenant is on the Azure for US Government cloud – access to specific resources can't be restricted by using the issuer ID or policy OIDs in the custom authentication strength policy.
147174
148
−## Troubleshooting authentication strength advanced options
175
+## Troubleshoot advanced options for authentication strength
149176
150
−### Users can't use their passkey (FIDO2) to sign in
177
+### Users can't use their passkey (FIDO2) to sign in
178
+
151179
A Conditional Access Administrator can restrict access to specific security keys. When a user tries to sign in by using a key they can't use, this **You can't get there from here** message appears. The user has to restart the session, and sign-in with a different passkey (FIDO2).
152180
153181
:::image type="content" border="true" source="./media/troubleshoot-authentication-strengths/restricted-security-key.png" alt-text="Screenshot of a sign-in error when using a restricted passkey (FIDO2).":::
154182
155
−
156183
### How to check certificate policy OIDs and issuer
157184
158185
You can confirm the personal certificate properties match the configuration in authentication strength advanced options.
159
−On the user’s device, sign in as an Administrator. Click **Run**, type `certmgr.msc`, and press Enter. To check policy OIDs, click **Personal**, right-click the certificate and click **Details**.
160186
161
−:::image type="content" border="true" source="./media/concept-authentication-strength-advanced-options/certificate-manager-msc.png" alt-text="Screenshot showing how to check certificate policy OIDs and issuer.":::
187
+On the user's device, sign in as an Administrator. Click **Run**, type `certmgr.msc`, and press Enter. To check policy OIDs, click **Personal**, right-click the certificate and click **Details**.
162188
163
−## Next steps
189
+:::image type="content" border="true" source="./media/concept-authentication-strength-advanced-options/certificate-manager-msc.png" alt-text="Screenshot that shows how to check certificate policy OIDs and issuer.":::
190
+
191
+## Related content
164192
165193
- [Built-in Conditional Access authentication strengths](concept-authentication-strengths.md)
166194
- [How authentication strength works for external users](concept-authentication-strength-external-users.md)
⋯ 1 unchanged line
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.