Microsoft Entra ID Certificate-Based Authentication (CBA) with Intune

Platforms

WindowsmacOS

Products

Entra IDIntunePKI

Result

Passwordless browser sign-in with a certificate, as single factor or MFA

Overview

Sign in to Microsoft Entra ID with user certificates that Intune deploys by SCEP, without AD FS. I test it in the browser on Windows 11 and macOS, with and without MFA.

Microsoft Entra ID (formerly Azure AD) Certificate-Based Authentication (CBA) lets users authenticate directly against Microsoft Entra ID with X.509 client certificates, for apps and browser sign-in. It removes the need for federated Active Directory Federation Services (AD FS) and the on-premises servers behind it, and it is free in every edition of Microsoft Entra ID. Key benefits include:

• No need for complex on-premises deployments or network configuration
• Directly authenticate against Microsoft Entra ID
• No management overhead or cost

CBA works with Conditional Access policies such as multifactor authentication (MFA). On my test devices, managed by Microsoft Intune, the user certificates are already installed through the Certificate Connector for Microsoft Intune with SCEP.

Prerequisites

Before you start, check that you have the following.

Configuration

With the prerequisites in place, set it up in this order.

Step	Console	What you set
3.1	Entra	Trusted certificate authorities in the PKI-based trust store
3.2	Entra	Certificate-based authentication policy
3.3	Intune	SCEP user certificate profile per platform

Upload the certificate authority (CA) to Microsoft Entra ID

Microsoft Entra admin center

Today you upload the trusted certificate authority (.cer) files in the Microsoft Entra admin center, in the new PKI-based trust store. Follow Step 1: Configure the CAs with a PKI-based trust store. When I wrote this post, I used the Azure AD PowerShell cmdlet New-AzureADTrustedCertificateAuthority, with the output below. The Azure AD PowerShell module is now retired.

C:\import-cert.ps1

Id                                   CertificateAuthorities
--                                   ----------------------
29728ade-6ae4-4ee9-9103-412912537da5 {class CertificateAuthorityInformation {...

PS C:\Users\Administrator> Get-AzureADTrustedCertificateAuthority

AuthorityType               : RootAuthority
CrlDistributionPoint        :
DeltaCrlDistributionPoint   :
TrustedCertificate          : {48, 130, 3, 117...}
TrustedIssuer               : CN=hmaslowski-RootCA, DC=hmaslowski, DC=com
TrustedIssuerSki            : A373733BD38889AACCF132BE72157F6F6106E404

Note: I don't have my CRL CDP published on the internet via an HTTP URL, so just for authentication testing I skipped the revocation line:

$new_ca.crlDistributionPoint="<CRL Distribution URL>"

In the Microsoft Entra admin center, this is the Certificate Revocation List URL field of the CA. Without a CRL, revoked certificates aren't blocked, so don't skip it in production.

Turn on CBA in Authentication methods

Microsoft Entra admin center

Sign in to the Microsoft Entra admin center (entra.microsoft.com) and browse to:

• Entra ID > Authentication methods > Policies > Certificate-based authentication

Under Basics:

• Enable: Yes (to enable CBA on the tenant)
• Target to All users or selected Users/Groups (to display an option to sign in with a certificate)

Microsoft now recommends targeting only groups of users who have valid certificates, not All users, because users in scope for CBA without a certificate can be locked out of MFA registration.

Under Configure,

Add rule type of Certificate issuer and from the drop-down list select your Trusted Certificate Authority (if it was imported successfully to Microsoft Entra ID)

When I wrote this post, the supported certificate username bindings were userPrincipalName or onPremisesUserPrincipalName. Today you can also bind the certificate fields SKI, SHA1PublicKey, IssuerAndSubject and IssuerAndSerialNumber to the certificateUserIds attribute. I used:

• SAN Principal Name: userPrincipalName
• SAN RFC822Name: userPrincipalName

Optionally, change the Protection Level attribute that has a default value of Single-factor authentication to Multi-factor authentication (MFA). However, this default setting will take effect only if there are no custom rules (Certificate issuer or Policy OID) configured that override the default.

The MFA is supported by using the Certificate issuer Subject and Policy OID (policy object identifier). The certificate policies are also known as issuance policies that are configured on the CA server in the Certificate Template extensions:

Deploy a SCEP user certificate with Intune

Intune admin center

In the Intune admin center (intune.microsoft.com), configure SCEP User certificate, one profile for every OS platform (Windows, Mac, iOS, Android) that is managed by Intune and where you want Microsoft Entra ID CBA to work:

• Certificate type: User
• Subject name format: CN={{UserName}}
• SAN attribute User principal name (UPN) and value {{UserPrincipalName}}

Additionally for Mac only, under the SCEP User certificate profile, you should Enable the Allow all apps access to private key. Otherwise, the user certificate won't show up for selection in a web browser. In current Intune versions, also select the user deployment channel for user certificates on macOS, so the certificate goes to the user keychain.

User Experience

If the user is in the scope of Conditional Access policy with MFA authentication enabled, during sign-in with a Certificate it will be prompted for MFA authentication or not depending on the presence of the Policy OID object identifier (1.2.3.4) if certificate authentication binding rules are configured.

Here are two videos showing a user signing in with the Client Certificate (Single-factor and Multifactor) to Microsoft Entra ID on Windows and Mac. User has a Conditional Access policy configured to require multi-factor authentication (MFA), however this requirement can be satisfied by the certificate authentication binding rules.

1) Microsoft Entra ID CBA as Single-factor authentication on Windows 11 with Chrome browser sign-in to MyApps portal (myapps.microsoft.com):

2) Microsoft Entra ID CBA with Multi-factor authentication (MFA) on macOS 12 with Chrome browser sign-in to MyApps portal (myapps.microsoft.com):