You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/concept-certificate-based-authentication-mobile-ios.md
+86-3Lines changed: 86 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ services: active-directory
6
6
ms.service: active-directory
7
7
ms.subservice: authentication
8
8
ms.topic: how-to
9
-
ms.date: 10/05/2022
9
+
ms.date: 10/27/2022
10
10
11
11
ms.author: justinha
12
12
author: vimrang
@@ -39,7 +39,7 @@ On-device certificates are provisioned on the device. Customers can use Mobile D
39
39
Customers can use external security keys to store their certificates. Security keys with certificates:
40
40
41
41
- Enable the usage on any device and doesn't require the provision on every device the user has
42
-
- Are hardwaresecured with a PIN, which makes them phishingresistant
42
+
- Are hardware-secured with a PIN, which makes them phishing-resistant
43
43
- Provide multifactor authentication with a PIN as second factor to access the private key of the certificate in the key
44
44
- Satisfy the industry requirement to have MFA on separate device
45
45
- Future proofing where multiple credentials can be stored including FIDO2 keys
@@ -59,7 +59,7 @@ Customers can use external security keys to store their certificates. Security k
59
59
60
60
### Vendors for External storage
61
61
62
-
Azure AD CBA will support certificates on YubiKeys. Users can install YubiKey authenticator application from YubiKey and do Azure AD CBA. Applications that don't use latest MSAL libraries need to also install Microsoft Authenticator.
62
+
Azure AD CBA supports certificates on YubiKeys. Users can install YubiKey authenticator application from YubiKey and do Azure AD CBA. Applications that don't use latest MSAL libraries need to also install Microsoft Authenticator.
63
63
64
64
## Microsoft mobile applications support
65
65
@@ -83,6 +83,89 @@ On iOS 9 or later, the native iOS mail client is supported.
83
83
84
84
To determine if your email application supports Azure AD CBA, contact your application developer.
85
85
86
+
## Support for certificates on hardware security key (preview)
87
+
88
+
Certificates can be provisioned in external devices like hardware security keys along with a PIN to protect private key access. Azure AD supports CBA with YubiKey.
89
+
90
+
### Advantages of certificates on hardware security key
91
+
92
+
Security keys with certificates:
93
+
94
+
- Can be used on any device, and don't need a certificate to be provisioned on every device the user has
95
+
96
+
- Are hardware-secured with a PIN, which makes them phishing-resistant
97
+
98
+
- Provide multifactor authentication with a PIN as second factor to access the private key of the certificate
99
+
100
+
- Satisfy the industry requirement to have MFA on separate device
101
+
102
+
- helps in future proofing where multiple credentials can be stored including FIDO2 (Fast Identity Online 2) keys.
103
+
104
+
### One-time registration prerequisite
105
+
106
+
- Have a PIV-enabled YubiKey with a smartcard certificate provisioned on it
107
+
- Download the [Yubico Authenticator for iOS app](https://apps.apple.com/app/yubico-authenticator/id1476679808) on your iPhone with v14.2 or later
108
+
- Open the app, insert the YubiKey or tap over near field communication (NFC) and follow steps to upload the certificate to iOS keychain
109
+
110
+
### Steps to test YubiKey on Microsoft apps on iOS mobile
111
+
112
+
1. Install the latest Microsoft Authenticator app.
113
+
1. Open Outlook and plug in your YubiKey.
114
+
1. Select **Add account** and enter your user principal name (UPN).
115
+
1. Click **Continue** and the iOS certificate picker will appear.
116
+
1. Select the public certificate copied from YubiKey that is associated with the user’s account.
117
+
1. Click **YubiKey required** to open the YubiKey authenticator app.
118
+
1. Enter the PIN to access YubiKey and select the back button at the top left corner.
119
+
120
+
The user should be successfully logged in and redirected to the Outlook homepage.
121
+
122
+
## Troubleshoot certificates on hardware security key
123
+
124
+
### What will happen if the user has certificates both on the iOS device and YubiKey?
125
+
126
+
The iOS certificate picker will show all the certificates on both iOS device and the ones copied from YubiKey into iOS device. Depending on the certificate user picks they will be either taken to YubiKey authenticator to enter PIN or directly authenticated.
127
+
128
+
### My YubiKey is locked after incorrectly typing PIN 3 times. How do I fix it?
129
+
130
+
- Users should see a dialog informing you that too many PIN attempts have been made. This dialog also pops up during subsequent attempts to select **Use Certificate or smart card**.
131
+
-[YubiKey Manager](https://www.yubico.com/support/download/yubikey-manager/) can reset a YubiKey’s PIN.
132
+
133
+
### Once CBA fails, clicking on the CBA option again in the ‘Other ways to signin’ link on the error page fails.
134
+
135
+
This issue happens because of certificate caching. We are working to add a fix to clear the cache. As a workaround, clicking cancel and restarting the login flow will let the user choose a new certificate and successfully login.
136
+
137
+
### Azure AD CBA with YubiKey is failing. What information would help debug the issue?
138
+
139
+
1. Open Microsoft Authenticator app, click the three dots icon in the top right corner and select **Send Feedback**.
140
+
1. Click **Having Trouble?**.
141
+
1. For **Select an option**, select **Add or sign into an account**.
142
+
1. Describe any details you want to add.
143
+
1. Click the send arrow in the top right corner. Note the code provided in the dialog that appears.
144
+
145
+
### How can I enforce phishing-resistant MFA using a hardware security key on browser-based applications on mobile?
146
+
147
+
Certificate based authentication + Conditional access auth strength capability makes it powerful for customers to enforce authentication needs. Edge as a profile (add an account) will work with a hardware security key like YubiKey and conditional access policy with authentication strength capability can enforce phishing resistant authentication with CBA
148
+
149
+
CBA support for YubiKey is available in the latest MSAL (Microsoft Authentication Library) libraries, any third-party application that integrates the latest MSAL as well as all Microsoft first party applications can leverage CBA + CA Auth strength.
150
+
151
+
### Supported operating systems
152
+
153
+
|Operating system | Certificate on-device/Derived PIV | Smart cards |
On iOS, users will see a "double prompt", where they must click the option to use certificate-based authentication twice. We're working to create a seamless user experience.
0 commit comments