Update concept-certificate-based-authentication-certificateuserids.md

Author: vimrang

articles/active-directory/authentication/concept-certificate-based-authentication-certificateuserids.md

@@ -134,8 +134,9 @@ To map the pattern supported by certificateUserIds, administrators must use expr
 You can use the following expression for mapping to SKI and SHA1-PUKEY:
 
 ```
-(Contains([alternativeSecurityId],"x509:\<SKI>")>0,[alternativeSecurityId],Error("No altSecurityIdentities SKI match found."))
-& IIF(Contains([alternativeSecurityId],"x509:\<SHA1-PUKEY>")>0,[alternativeSecurityId],Error("No altSecurityIdentities SHA1-PUKEY match found."))
+IF(IsPresent([alternativeSecurityId]),
+                Where($item,[alternativeSecurityId],BitOr(InStr($item, "x509:<SKI>"),InStr($item, "x509:<SHA1-PUKEY>"))>0),[alternativeSecurityId]
+)
 ```
 
 ## Look up certificateUserIds using Microsoft Graph queries