You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Certificate-based authentication on iOS - Azure Active Directory
3
-
description: Learn about the supported scenarios and the requirements for configuring certificate-based authentication in solutions with iOS devices
3
+
description: Learn about the supported scenarios and the requirements for configuring certificate-based authentication for Azure Active Directory in solutions with iOS devices
4
4
5
5
services: active-directory
6
6
ms.service: active-directory
7
7
ms.subservice: authentication
8
8
ms.topic: conceptual
9
-
ms.date: 01/15/2018
9
+
ms.date: 04/17/2020
10
10
11
11
ms.author: iainfou
12
12
author: iainfoulds
13
13
manager: daveba
14
-
ms.reviewer: annaba
15
14
16
15
ms.collection: M365-identity-device-management
17
16
---
18
17
# Azure Active Directory certificate-based authentication on iOS
19
18
20
-
iOS devices can use certificate-based authentication (CBA) to authenticate to Azure Active Directory using a client certificate on their device when connecting to:
19
+
To improve security, iOS devices can use certificate-based authentication (CBA) to authenticate to Azure Active Directory (Azure AD) using a client certificate on their device when connecting to the following applications or services:
21
20
22
21
* Office mobile applications such as Microsoft Outlook and Microsoft Word
23
22
* Exchange ActiveSync (EAS) clients
24
23
25
-
Configuring this feature eliminates the need to enter a username and password combination into certain mail and Microsoft Office applications on your mobile device.
24
+
Using certificates eliminates the need to enter a username and password combination into certain mail and Microsoft Office applications on your mobile device.
26
25
27
-
This topic provides you with the requirements and the supported scenarios for configuring CBA on an iOS device for users of tenants in Office 365 Enterprise, Business, Education, US Government, China, and Germany plans.
28
-
29
-
This feature is available in preview in Office 365 US Government Defense and Federal plans.
26
+
This article details the requirements and the supported scenarios for configuring CBA on an iOS device. CBA for iOS is available across Azure public clouds, Microsoft Government Cloud, Microsoft Cloud Germany, and Microsoft Azure China 21Vianet.
30
27
31
28
## Microsoft mobile applications support
32
29
@@ -45,40 +42,48 @@ This feature is available in preview in Office 365 US Government Defense and Fed
45
42
46
43
## Requirements
47
44
48
-
The device OS version must be iOS 9 and above
45
+
To use CBA with iOS, the following requirements and considerations apply:
46
+
47
+
* The device OS version must be iOS 9 or above.
48
+
* Microsoft Authenticator is required for Office applications on iOS.
49
+
* An identity preference must be created in the macOS Keychain that include the authentication URL of the ADFS server. For more information, see [Create an identity preference in Keychain Access on Mac](https://support.apple.com/guide/keychain-access/create-an-identity-preference-kyca6343b6c9/mac).
49
50
50
-
A federation server must be configured.
51
+
The following Active Directory Federation Services (ADFS) requirements and considerations apply:
51
52
52
-
Microsoft Authenticator is required for Office applications on iOS.
53
+
* The ADFS server must be enabled for certificate authentication and use federated authentication.
54
+
* The certificate needs to have to use Enhanced Key Usage (EKU) and contain the UPN of the user in the *Subject Alternative Name (NT Principal Name)*.
53
55
54
-
For Azure Active Directory to revoke a client certificate, the ADFS token must have the following claims:
(The string for the issuer of the client certificate)
58
+
For Azure AD to revoke a client certificate, the ADFS token must have the following claims. Azure AD adds these claims to the refresh token if they're available in the ADFS token (or any other SAML token). When the refresh token needs to be validated, this information is used to check the revocation:
60
59
61
-
Azure Active Directory adds these claims to the refresh token if they are available in the ADFS token (or any other SAML token). When the refresh token needs to be validated, this information is used to check the revocation.
60
+
*`http://schemas.microsoft.com/ws/2008/06/identity/claims/<serialnumber>` - add the serial number of your client certificate
61
+
*`http://schemas.microsoft.com/2012/12/certificatecontext/field/<issuer>` - add the string for the issuer of your client certificate
62
62
63
-
As a best practice, you should update your organization's ADFS error pages with the following information:
63
+
As a best practice, you also should update your organization's ADFS error pages with the following information:
64
64
65
-
* The requirement for installing the Microsoft Authenticator on iOS
65
+
* The requirement for installing the Microsoft Authenticator on iOS.
66
66
* Instructions on how to get a user certificate.
67
67
68
-
For more information, see [Customizing the AD FS Sign-in Pages](https://technet.microsoft.com/library/dn280950.aspx).
68
+
For more information, see [Customizing the AD FS sign in page](https://technet.microsoft.com/library/dn280950.aspx).
69
+
70
+
## Use modern authentication with Office apps
71
+
72
+
Some Office apps with modern authentication enabled send `prompt=login` to Azure AD in their request. By default, Azure AD translates `prompt=login` in the request to ADFS as `wauth=usernamepassworduri` (asks ADFS to do U/P Auth) and `wfresh=0` (asks ADFS to ignore SSO state and do a fresh authentication). If you want to enable certificate-based authentication for these apps, modify the default Azure AD behavior.
69
73
70
-
Some Office apps (with modern authentication enabled) send '*prompt=login*' to Azure AD in their request. By default, Azure AD translates '*prompt=login*' in the request to ADFS as '*wauth=usernamepassworduri*' (asks ADFS to do U/P Auth) and '*wfresh=0*' (asks ADFS to ignore SSO state and do a fresh authentication). If you want to enable certificate-based authentication for these apps, you need to modify the default Azure AD behavior. Just set the '*PromptLoginBehavior*' in your federated domain settings to '*Disabled*'.
71
-
You can use the [MSOLDomainFederationSettings](/powershell/module/msonline/set-msoldomainfederationsettings?view=azureadps-1.0) cmdlet to perform this task:
74
+
To update the default behavior, set the '*PromptLoginBehavior*' in your federated domain settings to *Disabled*. You can use the [MSOLDomainFederationSettings](/powershell/module/msonline/set-msoldomainfederationsettings?view=azureadps-1.0) cmdlet to perform this task, as shown in the following example:
On iOS 9 or later, the native iOS mail client is supported. For all other Exchange ActiveSync applications, to determine if this feature is supported, contact your application developer.
82
+
On iOS 9 or later, the native iOS mail client is supported. To determine if this feature is supported for all other Exchange ActiveSync applications, contact your application developer.
78
83
79
84
## Next steps
80
85
81
-
If you want to configure certificate-based authentication in your environment, see [Get started with certificate-based authentication on Android](../authentication/active-directory-certificate-based-authentication-get-started.md) for instructions.
86
+
To configure certificate-based authentication in your environment, see [Get started with certificate-based authentication](active-directory-certificate-based-authentication-get-started.md) for instructions.
0 commit comments