Authentication Method Policy - Certificate-Based Authentication
Certificate-based authentication (CBA) allows users to authenticate using X.509 certificates issued by an enterprise or federated certificate authority. It provides phishing-resistant, strong authentication and can be configured to require specific certificate bindings, issuer hints, and user name bindings.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Method enabled | Specifies whether the certificate-based authentication method is enabled or disabled for the tenant. Learn more |
| Included users | Groups and users explicitly included to use the certificate-based authentication method. Learn more |
| Excluded users | Groups and users explicitly excluded from using the certificate-based authentication method. Learn more |
| Username binding policy | Defines fields in the X.509 certificate that map to attributes of the Microsoft Entra user object to bind the certificate to the user account. Learn more |
| Authentication binding rules | Defines strong authentication configurations. This includes the default authentication mode and the different rules for strong authentication bindings. Learn more |
| Default affinity level | Note: The default affinity will ensure the certificates binding used provides the default affinity level unless special rules are applied. Learn more |
| CRL validation enabled | Defines the Certificate Revocation List (CRL) validation configuration. When enabled, the system validates that certificates have not been revoked before allowing authentication. Learn more |
| Issuer hints enabled | Enable issuer hints to show only the valid certificates in the certificate picker during authentication. Learn more |
Configure it
Add this to the tenant, or roll it out through a scheme, when you want users to be able to sign in with a smart card or X.509 certificate instead of, or alongside, a password. It’s a phishing-resistant method common with government, healthcare and regulated clients.
-
Add the baseline to the tenant directly (Adding a baseline) or through a scheme (Deploying a scheme).
-
Turn on Method enabled, and leave Included users targeting all users unless only some of the tenant’s users will hold certificates.
-
Leave Username binding policy mapping the certificate’s principal name to the user’s userPrincipalName. This binding is what ties a presented certificate to the right Entra account.
-
Turn on CRL validation enabled so a revoked certificate can no longer be used to sign in.
-
Save. The baseline only adds a sign-in option, so Auto-remediation is safe to turn on: it can’t stop anyone using a password if their certificate isn’t set up.
Certificate sign-in takes effect only once your organisation, or a federated partner, has a certificate authority issuing user certificates that Microsoft Entra trusts. Octiga can’t create that trust for you.
Check it worked
Passing means Entra ID → Authentication methods → Policies → Certificate-based authentication shows the method enabled with the same username binding. Users with an issued and trusted certificate can now choose “Sign in with a certificate” on the sign-in page instead of typing a password; anyone without one is unaffected.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.