# Authentication Method Policy - Certificate-Based Authentication

> Certificate-based authentication (CBA) allows users to authenticate using X.

Certificate-based authentication (CBA) allows users to authenticate using X.509 certificates issued by an enterprise or federated certificate authority. It provides phishing-resistant, strong authentication and can be configured to require specific certificate bindings, issuer hints, and user name bindings.

## Settings this baseline controls

| Setting                      | What it does                                                                                                                                                                                                                                                                                            |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Method enabled               | Specifies whether the certificate-based authentication method is enabled or disabled for the tenant. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/x509certificateauthenticationmethodconfiguration)                                                                               |
| Included users               | Groups and users explicitly included to use the certificate-based authentication method. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/x509certificateauthenticationmethodconfiguration)                                                                                           |
| Excluded users               | Groups and users explicitly excluded from using the certificate-based authentication method. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/x509certificateauthenticationmethodconfiguration)                                                                                       |
| Username binding policy      | Defines fields in the X.509 certificate that map to attributes of the Microsoft Entra user object to bind the certificate to the user account. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/x509certificateauthenticationmethodconfiguration)                                     |
| Authentication binding rules | Defines strong authentication configurations. This includes the default authentication mode and the different rules for strong authentication bindings. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/x509certificateauthenticationmethodconfiguration)                            |
| Default affinity level       | Note: The default affinity will ensure the certificates binding used provides the default affinity level unless special rules are applied. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/x509certificateauthenticationmethodconfiguration)                                         |
| CRL validation enabled       | Defines the Certificate Revocation List (CRL) validation configuration. When enabled, the system validates that certificates have not been revoked before allowing authentication. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/x509certificateauthenticationmethodconfiguration) |
| Issuer hints enabled         | Enable issuer hints to show only the valid certificates in the certificate picker during authentication. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/x509certificateauthenticationmethodconfiguration)                                                                           |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

Add this to the tenant, or roll it out through a scheme, when you want users to be able to sign in with a smart card or X.509 certificate instead of, or alongside, a password. It's a phishing-resistant method common with government, healthcare and regulated clients.

1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)) or through a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Turn on **Method enabled**, and leave **Included users** targeting all users unless only some of the tenant's users will hold certificates.
3. Leave **Username binding policy** mapping the certificate's principal name to the user's userPrincipalName. This binding is what ties a presented certificate to the right Entra account.
4. Turn on **CRL validation enabled** so a revoked certificate can no longer be used to sign in.
5. Save. The baseline only adds a sign-in option, so **Auto-remediation** is safe to turn on: it can't stop anyone using a password if their certificate isn't set up.

Certificate sign-in takes effect only once your organisation, or a federated partner, has a certificate authority issuing user certificates that Microsoft Entra trusts. Octiga can't create that trust for you.

## Check it worked

Passing means **Entra ID → Authentication methods → Policies → Certificate-based authentication** shows the method enabled with the same username binding. Users with an issued and trusted certificate can now choose "Sign in with a certificate" on the sign-in page instead of typing a password; anyone without one is unaffected.

## Standards this addresses

### ISO 27001

- **A.8.3.3** — ISO/IEC 27001:2022 Annex A.8.3.3

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)