In-Depth Guide to Microsoft Entra Certificate-Based Authentication (CBA)

Step 1: Upload Certificate Authorities

📍Where:
Entra Admin Center → Protection → Security Center → Certificate Authorities

📄 What You Upload:

• Root CA: The top-most authority in the chain

• Intermediate CA(s): Subordinate authorities issuing certificates

🛑 Important Configuration:

• Configure the Certificate Revocation List (CRL) or OCSP.

• Without this, revoked certificates will still be accepted, posing a major risk.

💡 Tip: Use Base64 PEM format when uploading.

Step 2: Enable CBA in Authentication Methods

📍Where:
Entra Admin Center → Authentication Methods → Certificate-Based Authentication

📌 Configuration Options:

• Targeting: Choose either “All users” or a specific group.

  • Best practice: Use a test group first.

• Protection Level:

  • 🔐 Single Factor: Cert only.

  • 🔐 Multi-Factor: Certificate protected with biometric or PIN.

• Default Binding Strengths:

  • Can be overridden using custom rules based on Policy OID, Issuer, or Certificate Field.

Step 3: Authentication Binding

Authentication binding defines the strength of the authentication method used.

🟡 Low Affinity Binding:

• Uses certificate fields like:

  • Subject Alternative Name (SAN)

  • RFC822 Name

  • Principal Name (UPN)

• These can be reused and don’t change on certificate rotation.

🟢 High Affinity Binding:

• Uses fields like:

  • Subject Key Identifier (SKI)

  • Serial Number

• These are unique and regenerate with every certificate issuance.

📊 Security Tip: Always prefer high-affinity bindings for multi-factor scenarios.

Step 4: Create Custom Rules

You can apply custom logic using:

• Certificate Issuer

• Policy Object Identifier (OID)

• Authentication Strength override

• Binding Strength override

💡Example:
If Policy OID = 1.2.840.113549.1.9.1, treat it as multi-factor because it was issued to smartcards with biometrics.

Step 5: Configure Username Binding

Username Binding maps a certificate field value to a user attribute in Entra ID.

🔁 Examples:

• Map SAN.UPN → userPrincipalName

• Map SKI → extensionAttribute1

💡 Ensure that the mapped value exists on the user object; otherwise, authentication will fail.

Step 6: Add SKI to User Profile

If you’re using Subject Key Identifier (SKI) for authentication:

1. Locate the certificate.

2. Copy the SKI.

3. Paste it into the corresponding user attribute in Entra.

4. Save changes.

This ensures Entra can map the certificate to the user correctly.